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Changes  to  this  Edition 

This  document  is  an  updated  version  of  RCC  Document  321-16  (Common  Risk  Criteria 
for  National  Test  Ranges).  The  following  is  a  list  of  changes. 

Note:  The  use  of  the  word  “supplement”  used  herein  refers  to  the  companion 
(supplemental)  document  to  RCC  Document  321. 

a.  Added  a  two-tiered  risk  management  process  for  the  protection  of  public  infrastructure. 

b.  Included  provisional  acceptable  risk  criteria  for  public  infrastructure. 
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Preface 

This  is  the  foundational  document  that  defines  consensus  standards  for  the  range  risk 
management  process  and  risk  criteria.  The  companion  document1  provides  additional  detailed 
information  to  assist  in  implementation  of  the  standards.  The  standards  in  this  document  are  not 
considered  absolute;  rather,  this  document  and  its  supplement  are  intended  to  provide  a  baseline 
for  defining  acceptable  risks  for  hazardous  range  operations  and  to  assist  the  user  in  the 
development  and  implementation  of  robust  risk  assessments. 

This  document  presents  the  results  of  an  extensive  cooperative  effort  by  the  Range  Safety 
Group  of  the  Range  Commanders  Council.  Planned  and  unplanned  hazardous  events  generated 
by  flight  operations  present  a  safety  concern  for  all  test  ranges.  Each  range  has  established  its 
own  set  of  criteria  and  analytical  methods  for  protecting  personnel,  facilities,  aircraft,  and  other 
assets  from  hazardous  operations.  Although  these  separate  efforts  have  been  very  successful,  the 
logical  relationships  among  criteria  used  at  the  test  ranges  and  across  different  hazards  are  often 
difficult  to  comprehend.  The  consensus  standards  presented  in  this  document  are  intended  to: 

a.  Promote  a  common  set  of  safety  standards  and  process  among  the  ranges; 

b.  Promote  valid,  repeatable  risk  assessments; 

c.  Facilitate  innovation  to  support  challenging  missions; 

d.  Nurture  openness  and  trustworthiness  among  the  ranges,  range  users,  and  the  public; 

e.  Simplify  the  scheduling  process; 

f.  Present  common  risk  criteria  that  can  reduce  cost  for  users  of  multiple  test  ranges. 

The  RCC  gives  special  acknowledgement  for  production  of  this  document  to: 

Dr.  Paul  Wilde,  Chairman,  RSG  Risk  Committee 

Deputy  Chief  Engineer,  Federal  Aviation  Administration,  AST-4 

800  Independence  Ave,  SW.  Rm  331 

Washington,  D.C.  20591 

Phone  (202)  267-5727 

E-mail  Paul.Wilde@faa.gov 

Please  direct  any  questions  to: 

Secretariat,  Range  Commanders  Council 
ATTN:  CSTE-WS-RCC 
1510  Headquarters  Avenue 

White  Sands  Missile  Range,  New  Mexico  88002-5110 
Phone  (575)  678-1107,  DSN  258-1107 

E-mail  usarmv.wsmr.atec.list.rcc@mail.mil 


1  Range  Commanders  Council.  Common  Risk  Criteria  for  National  Test  Ranges  (Supplement).  321-10 
(Supplement).  December  2010.  May  be  superseded  by  update.  Retrieved  28  July  2016.  Available  to  RCC  members 
with  Private  Portal  access  at  https://wsdmext.wsmr.army.mil/site/rccpri/Publications/321- 
10  Supplement  Common  Risk  Criteria  Standards  For  National  Test  Ranges/. 
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CHAPTER  1 

Introduction 


1.1  Purpose 

This  document  provides  a  common  set  of  range  safety  policies,  risk  criteria,  and 
guidelines  for  managing  risk  to  people  and  assets  during  manned  and  unmanned  flight 
operations,  excluding  aviation  operations.  It  establishes  the  following: 

a.  Acceptable  risk  criteria  for  both  the  general  public  (GP)  (involuntary  acceptance)  and 
mission-essential  personnel  (MEP)  (voluntary  acceptance),  excluding  people  in  the 
launch  or  reentry  vehicle; 

b.  Debris  injury  thresholds  for  unprotected  people; 

c.  Debris  hazard  thresholds  for  aircraft  and  ships; 

d.  Vulnerability  models  for  large  commercial  transport  aircraft  and  business-class  jets; 

e.  Approach  for  evaluating  flight  hazards  to  critical  assets; 

f.  Provisional  acceptable  risk  criteria  for  unoccupied  or  largely  unoccupied  public 
infrastructure. 

1.2  Scope 

The  policies  and  criteria  in  this  document  are  intended  for  use  by  members  of  the 
Department  of  Defense  (DoD)  national  ranges  and  Major  Range  and  Test  Facility  Bases 
(MRTFBs).  These  policies  and  criteria  apply  to  launch  and  reentry  hazards  generated  by 
endoatmospheric  and  exoatmospheric  range  activities,  including  both  guided  and  unguided 
missiles  and  missile  intercepts,  space  launches,  and  reentry  vehicles.  This  does  not  include 
aviation  operations  or  unmanned  aerial  vehicle  (UAV)  operations.  The  Range  Commanders 
Council  (RCC)  document  323-992  provides  criteria  for  UAVs. 

1.3  Implementation 

This  document  is  an  advisory  document.  Its  content  is  based  on  the  consensus  positions 
held  by  the  Risk  Committee  (RC)  within  the  Range  Safety  Group  (RSG),  which  is  made  up  of  a 
broad  cross-section  of  the  US  range  safety  community.  Therefore,  the  content  of  this  document 
represents  consensus  standards.  The  main  body  of  this  document  provides  consensus  standards 
with  the  highest  levels  of  priorities  while  the  supplement  contains  lower  levels  of  priority 
requirements,  guidelines,  and  example  methods;  however,  precise  language  is  used  in  both  this 
document  and  the  supplement  in  an  attempt  to  capture  the  intent  of  the  RC  as  follows. 

•  The  words  “must,”  “shall,”  and  “will”  indicate  a  requirement  that  is  strongly 
recommended.  Fegitimate  alternatives  may  exist,  but  each  alternative  shall 
demonstrate  an  equivalent  level  of  safety  or  be  granted  a  waiver. 


2  Range  Commanders  Council.  Range  Safety  Criteria  for  Unmanned  Air  Vehicles.  RCC  323-99.  December  1999. 
May  be  superseded  by  update.  Retrieved  6  April  2016.  Available  at 
http://www.wsmr.army.mil/RCCsite/Documents/323- 
99  Range  Safety  Criteria  Unmanned  Air  Vehicles  (BasicV323-99.pdf. 


1-1 


Common  Risk  Criteria  Standards  for  National  Test  Ranges,  RCC  321-17,  September  2017 


•  “Should”  indicates  an  advisory  requirement  or  a  highly  desirable  procedure.  When 
this  standard  uses  “should,”  the  committee  intends  that  a  range  will  achieve 
compliance  to  the  maximum  extent  practical,  but  no  waiver  or  equivalent  level  of 
safety  will  be  required. 

•  “Can”  and  “may”  permit  a  choice  and  express  a  guideline. 

In  order  for  a  range  to  effectively  implement  this  document,  the  range  should  evaluate  the 
contents  of  this  document  and  incorporate  it  accordingly  into  the  local  regulations  and 
requirements. 

1.4  Range  Responsibilities 

High-level  authorizing  documents,  such  as  the  Department  of  Defense  Instruction  (DoDI) 
3200. 18, 3  assign  responsibility  to  each  range  commander4  (or  other  launch/reentry  decision 
authority  for  non-DoD  facilities)  for  ensuring  that  all  missions  are  conducted  safely,  consistent 
with  operational  requirements.  Range  flight  operations  typically  involve  some  level  of  risk. 
Therefore,  an  important  aspect  of  the  range  safety  responsibility  is  to  ensure  that  the  risk  is 
properly  managed  within  prescribed  limits.  To  accomplish  this,  each  range  commander  (or 
designee)  must  perform  the  following. 

a.  Establish  risk  management  procedures  (including  hazard  containment)  to  implement  the 
risk  management  process  described  herein. 

b.  Establish  acceptable  risk  criteria  appropriate  to  each  type  of  mission  flown  in 
consideration  of  the  guidance  provided  herein. 

c.  Accept  any  risks,  including  those  that  exceed  the  established  risk  criteria  when  warranted 
for  a  mission  in  consideration  of  the  operational  requirements  and  national  need. 

(1)  Make  such  decisions  based  on  a  thorough  understanding  of  any  additional  risk  that 
exceeds  the  risk  criteria  and  the  benefits  to  be  derived  from  taking  the  additional 
risk. 

(2)  Ensure  such  decisions  are  documented  in  a  formal  waiver  process  (or  equivalent), 
preferably  in  advance  of  the  mission. 

d.  Maintain  related  range  policy  and  requirements  documents. 

e.  Maintain  records  of  risk  assessments  and  waivers  to  established  risk  criteria. 

f.  For  a  mission  involving  more  than  one  range: 

(1)  coordinate  with  the  other  range(s)  to  clearly  document  safety  responsibility  for  each 
phase  of  the  mission; 

(2)  develop  and  implement  joint  plans  for  controlling  the  mission  risk  due  to  all 
planned  and  unplanned  events. 


3  Department  of  Defense.  “Subject:  Management  and  Operation  of  the  Major  Range  and  Test  Facility  Base 
(MRTFB).”  1  February  2010.  May  be  superseded  by  update.  Retrieved  6  April  2016.  Available  at 
http://www.dtic.mil/whs/directives/corres/pdf/320018p.pdf. 

4  This  document  uses  “range  commander”  to  refer  to  the  duly  authorized  launch  or  reentry  decision  authority. 
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CHAPTER  2 

Policies  and  Procedures 

2.1  General  Policy  and  Goals 

In  planning  any  operation,  risk  must  be  reduced  to  the  extent  that  is  practical  in  keeping 
with  operational  objectives.  Safety  should  be  balanced  with  operational  objectives  by 
cooperative  interaction  between  the  range  and  the  range  user.  To  maximize  achievement  of 
mission  objectives  within  safety  constraints,  the  range  user  should  consider  overall  risk  along 
with  other  factors  that  affect  mission  acceptability.  These  factors  include  criticality  of  mission 
objectives,  protection  of  life  and  property,  the  potential  for  high-consequence  mishaps,  local 
political  factors,  and  governing  range  or  programmatic  environmental  requirements. 

All  ranges  should  strive  to  achieve  complete  containment  of  hazards  resulting  from  both 
normal  and  malfunctioning  flights.  If  a  planned  mission  cannot  be  accomplished  using  a 
containment  approach,  a  risk  management  approach  may  be  authorized  by  the  range  commander 
or  the  designated  representative.  The  risk  management  approach  should  conform  to  the 
guidelines  presented  in  this  document  or  otherwise  demonstrate  compliance  with  the  objectives 
presented. 

Range  commanders  should  never  regard  events  (such  as  injuries)  as  being  routine  or 
permissible.  No  adverse  consequences  are  routinely  acceptable;  however,  the  probability  is  finite 
that  range  mishaps  producing  adverse  consequences  may  occur.  The  term  “acceptable  risks” 
used  in  this  document  can  be  properly  interpreted  as  “tolerable  risks.”  These  are  risks  the  range 
commander  may  tolerate  to  secure  certain  benefits  from  a  range  activity  with  the  confidence  that 
the  risk  is  properly  managed  within  prescribed  limits. 

Compliance  with  this  document  leads  to  defensible  launch  support  and  launch  commit 
decisions.  Employing  a  sound  basis  for  accuracy  and  repeatability  in  risk  assessments  leads  to 
consistent  risk  acceptance  decisions,  thereby  fostering  public  confidence  that  the  ranges  are 
operated  with  appropriate  regard  for  safety.  Thus,  individuals  living  or  working  at  or  near  a 
range  may  go  about  their  daily  lives  without  concern  for  their  proximity  to  range  activities. 
Moreover,  compliance  with  these  guidelines  provides  assurance  that  flights  near  or  over 
communities  by  space  boosters  or  weapon  systems  does  not  significantly  increase  the  risk  to 
these  communities.  These  goals  have  led  to  the  policy  objectives  provided  here. 

In  defining  objectives  for  risk  assessment  and  risk  management,  the  RCC  goals  are  to: 

a.  Create  a  common  set  of  safety  standards  and  processes  among  the  ranges  that  will 

achieve  the  stated  risk  management  goals; 

b.  Promote  accurate,  repeatable  risk  assessments  by  minimizing  errors  in  estimating  and 

ensuring  their  scientific  validity; 

c.  Facilitate  innovation  to  support  challenging  missions; 

d.  Nurture  openness  and  trustworthiness  among  the  ranges,  range  users,  and  the  public. 
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2.2  Policy  Objectives 

2.2.1  General  Public 

The  GP  includes  all  people  located  on-  and  off-base  that  are  not  essential  to  a  specific 
mission  or  nearby  critical  operation.  This  definition  applies  to  all  people  regardless  of  whether 
they  are  in  some  mode  of  transportation  (such  as  airplanes,  ships,  and  busses),  are  within  a 
structure,  or  are  unsheltered.  The  GP  should  not  be  exposed,  individually  or  collectively,  to  a  risk 
level  greater  than  the  background  risk  in  comparable  involuntary  activities,  and  the  risk  of  a 
catastrophic  mishap  should  be  mitigated. 

In  the  above  context,  the  RCC  considers  “comparable  involuntary  activities”  as  those 
where  the  risk  arises  from  manmade  activities  that: 

a.  Are  subject  to  government  regulations  or  are  otherwise  controlled  by  a  government 

agency; 

b.  Are  of  vital  interest  to  the  US;  and 

c.  Impose  involuntary  risk  of  serious  injury  or  worse  on  the  public. 

2.2.2  Mission-Essential  Personnel 

A  certain  degree  of  risk  is  inherent  in  hazardous  operations.  The  MEP  may  include 
persons  in  training  to  perform  specific  tasks  that  are  part  of  the  current  operation.  The  range 
commander  or  mission  director  (or  their  designees)  should  identify  the  MEP  in  training  and 
justify  their  designation  as  MEP.  The  MEP  should  not  be  exposed,  individually  or  collectively, 
to  a  risk  level  greater  than  that  found  in  comparable  high-risk  occupations,  and  the  risk  of  a 
catastrophic  mishap  should  be  mitigated. 

2.2.3  Critical  Operations  Personnel 

Critical  operations  personnel  (COP)  include  persons  not  essential  to  the  specific 
operation  or  launch  currently  being  conducted,  but  who  are  required  to  perform  safety,  security, 
or  other  critical  tasks  at  the  range.  The  critical  operations  range  user  (or  manager)  provides  the 
number  and  justification  of  personnel  required  to  conduct  the  critical  operations.  The  range 
safety  personnel  will  approve  or  determine  the  number  and  location  of  COP  with  the 
concurrence  of  the  appropriate  decision  authority.  The  COP  should  be  included  in  the  same 
risk  category  as  MEP. 

2.2.4  Catastrophe  Potential  and  Transportation  Systems 

People  on  aircraft,  ships,  and  other  modes  of  transportation  and  people  on  oilrigs  and 
offshore  platforms  should  be  protected  to  a  level  commensurate  with  the  background  risk 
associated  with  those  activities.  The  risk  assessment  should  account  for  potential  catastrophic 
consequences  to  all  exposed  people,  and  mitigations  should  be  implemented  to  ensure  that  the 
risk  from  catastrophic  events  is  consistent  with  the  allowable  risk  given  in  Subsection  3.7.3  and 
Subsection  3.7.4. 

Scenario-specific  information  should  be  considered  in  providing  protection  against 
catastrophic  consequences.  Combinations  of  factors  that  should  be  considered  include  the 
number  of  people  who  may  be  simultaneously  injured,  the  risk  of  damage  to  high-value  assets, 
the  risk  of  a  casualty,  factors  that  may  significantly  impair  the  range’s  ability  to  perform  its 
mission,  and  factors  that  may  have  national  or  international  consequences. 
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Transportation  systems  include  all  modes  of  transportation  such  as  airplanes,  ships, 
trains,  busses,  and  automobiles.  People  in  transportation  systems  must  be  categorized  following 
the  same  rules  that  apply  to  unsheltered  people  and  people  in  fixed  shelters  (i.e.,  MEP,  COP,  or 
GP).  Each  individual  in  a  transportation  system  must  be  protected  to  the  level  for  his  or  her 
population  category  (MEP,  COP,  or  GP).  Collective  risk  must  be  assessed  to  include  people  in 
transportation  systems.  The  collective  risk  to  people  in  transportation  systems  must  be  added  to 
the  collective  risk  for  unsheltered  people  and  the  collective  risk  for  sheltered  people.  The 
numerical  value  defining  the  acceptability  of  the  total  collective  risk  must  be  based  on  the 
population  category.  Additional  protection,  such  as  defined  in  Section  3/7,  must  be  applied  to 
people  in  transportation  systems  in  order  to  minimize  the  potential  for  catastrophic  risk. 

2.2.5  Spacecraft 

Orbiting  manned  spacecraft  will  be  protected  to  a  level  equivalent  to  that  provided  to 
mission-essential  aircraft.  When  the  planned  missions  involve  vehicles  or  propagated  hazards 
with  altitude  capability  greater  than  150  kilometers  (km),  ranges  should  coordinate  with  the  Joint 
Space  Operations  Squadron  (JSpOC)  for  conjunction  assessment  if  needed.  In  addition,  ranges 
should  establish  collision  avoidance  (COLA)  periods  in  the  launch  window  if  there  are  any 
manned  spacecraft  within  50  km  of,  or  lower  than,  the  3-sigma  altitude  capability  of  the  launch 
vehicle,  payloads,  jettisoned  objects,  or  debris  cloud  boundary. 

The  RC  recognizes  that  protection  for  critical  unmanned  space  systems  should  also  be 
provided  because  orbital  debris  mitigation  is  a  national  policy  goal.  The  most  recent  National 
Space  Policy  of  the  United  States  (dated  June  28,  2010)  states  that  “the  United  States  will  pursue 
the  following  goals  in  its  national  space  programs  . . .  strengthening  measures  to  mitigate  orbital 
debris.”5  While  DoD  Directive  (DoDD)  3100.106  states  that  DoD  activities  are  to  be  conducted 
“. .  .in  a  safe  and  responsible  manner  that  protects  space  systems. . it  does  not  specify  which 
DoD  activity,  the  launching  agency  (range  user)  or  the  range,  has  the  responsibility  for  assuring 
this  protection.7  In  the  absence  of  clear  direction,  the  RC  recommends  that  the  launching 
agencies  and  the  ranges  adopt  the  provisional  standards  specified  in  Section  3.6.  In  the  case  of 
the  Air  Force,  the  roles  and  responsibilities  for  COLA  are  documented  in  AFI  9 1-2 17. 8 

2.2.6  Critical  Assets 

Damage  to  range  resources  can  have  public  safety  and  mission  assurance  implications. 

As  a  minimum,  the  decision  authority  should  protect  resources  that  could  increase  the  risk  to 
surrounding  population  centers  if  they  were  damaged  or  not  available  in  the  event  of  an 
emergency.  Additionally,  since  national  security  is  dependent  on  range  resources,  the  decision 


5  Office  of  the  President,  United  States  of  America.  National  Space  Policy  of  the  United  States  of  America.  28  June, 
2010.  May  be  superseded  by  update.  Retrieved  7  April  2016.  Available  at 
https://www.whitehouse.gov/sites/default/files/national  space  policy  6-28-10. pdf. 

6  Department  of  Defense.  “Subject:  Space  Policy.”  DoDD  3100.10.  18  October  2012.  May  be  superseded  by  update. 
Retrieved  6  April  2016.  Available  at  http://www.dtic.mil/whs/directives/corres/pdf/310010p.pdf. 

7  Historically,  protection  of  unmanned  systems  has  been  addressed  as  part  of  mission  assurance  by  the  launching 
agency  but  only  for  DoD  missions  or  highly  valued  NASA  missions.  In  the  commercial  space  industry,  the  launch 
operator  must  obtain  liability  insurance  to  cover  such  potential  mishaps  and  has  historically  not  required  conjunction 
assessments  for  mission  assurance  or  unmanned  asset  protection  purposes. 

8  Department  of  the  Air  Force.  “Space  Safety  and  Mishap  Prevention  Program.”  AFI  91-217.  11  April  2014.  May 
be  superseded  by  update.  Retrieved  1 1  May  2016.  Available  at  http://static.e- 

publishing. af. mil/production/1  /af  se/publication/afi9 1  -2 1 7/aft9 1-21 7 .pdf. 


2-3 


Common  Risk  Criteria  Standards  for  National  Test  Ranges,  RCC  321-17,  September  2017 


authority  should  consider  the  protection  of  selected  facilities  and  equipment  necessary  to  conduct 
the  range’s  mission. 

In  this  standard,  critical  assets  include  property  (typically  government  property)  that  is 
essential  to  protect  the  public  health  and  safety,  maintain  the  minimum  operations  of  the  range, 
or  protect  the  national  security  or  foreign  policy  interests  of  the  United  States.  It  includes 
property/infrastructure  that  must  remain  operational  following  a  mishap,  such  as  range  facilities 
and  equipment,  as  well  as  hospitals,  and  fire  stations. 

The  criteria  for  protecting  critical  assets  depend  on  the  consequences  of  an  impact.  It  can 
be  influenced  by  the  importance  of  the  critical  asset  in  terms  of  emergency  response  or  continued 
range  operations,  the  down  time  and  cost  of  repairing  the  critical  asset,  and  other  considerations. 
Therefore,  the  individual  ranges  need  to  establish  the  protection  criteria  to  meet  the  policy 
objective  for  their  particular  situation.  Sample  criteria  are  included  in  Chapter  4  of  the 
supplement.  The  ranges  may  need  to  modify  the  criteria  to  fit  the  conditions  at  their  particular 
range. 

2.2.7  On-Base  and  Off-Base  Public  Infrastructure 

The  term  “infrastructure”  refers  to  equipment  and  facilities;  it  excludes  mission-critical 
assets.  Equipment  and  facilities  that  comprise  part  of  an  on-  or  off-base  renewable  energy 
system,  such  as  wind  turbine  generation  facilities  and  associated  transmission  lines,  are  examples 
of  infrastructure  for  which  the  risk  management  process  and  provisional  criteria  specified  in  this 
standard  should  apply. 

With  the  encroachment  of  public  facilities  (which  may  be  either  on  or  nearby  base 
installations)  that  are  large  and/or  include  fragile  subsystems  critical  for  operations,  missions 
conducted  at  MRTFB  facilities  may  directly  produce  threats  to  the  infrastructure  that  comprises 
those  facilities;  and  likewise  the  actual  or  perceived  impact  of  minimizing  the  risk  to  such 
infrastructure  can  (and  has  in  the  past)  indirectly  affect  MRTFB  activities  by  imposing  holds  or 
mission  changes  and/or  cancellations. 

In  order  to  protect  unoccupied  or  largely  unoccupied  public  infrastructure,  the  initial 
standard  focuses  on  proposed  developments  involving  renewable  power  generation  and  electrical 
power  distribution,  with  immediate  consequences  from  MRTFB  activities  the  central  concern 
(consequences  from  latent  and/or  delayed  damage  are  excluded).  While  consequences  from 
latent  and/or  delayed  damage  are  excluded,  secondary  public  safety  consequences  are  addressed 
due  to  the  network-centric  nature  of  public  infrastructure.  This  is  because  these  consequences 
could  create  a  significant  public  safety  impact,  such  as  loss  of  electrical  power  in  a  city  for  an 
extended  period  or  exposure  to  the  release  of  hazardous  material. 

2.2.8  Environment 

As  part  of  environmental  documentation  preparation  in  compliance  with  federal  and  local 
regulations,  launch  and  flight  test  hazards  should  be  taken  into  account  and  mitigated  as 
necessary.  While  safety  is  a  factor  in  environmental  compliance,  environmental  protection  and 
regulation  are  beyond  the  scope  of  this  standard. 

2.3  Risk  Management  Process 

Risk  management  is  a  systematic  and  logical  process  to  identify  hazards  and  control  the 
risk  they  pose.  This  process  should  include  the  following  elements  (phases)  described  in  Figure 
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2-1.  Table  2-1  lists  the  phases  and  the  subsections  of  this  document  that  provide  more  detail  for 
each. 


Figure  2-1.  Risk  Management  Process 


Table  2-1.  Four  Phases  of  Risk  Management  Process 

Phase 

Title 

Subsection 

I 

Mission  Definition  and  Hazard  Identification 

2.3.1  I 

II 

Risk  Assessment 

2.3.2 

III 

Criteria  Comparison  and  Risk  Reduction 

2.3.3 

IV 

Risk  Acceptance 

2.3.4  1 

The  initial  goals  of  the  risk  management  approach  are  to  contain  the  hazards  and  isolate 
them  from  populated  areas  wherever  practical.  An  alternative  to  hazard  isolation  is  to  define 
hazard  containment  areas  so  as  to  minimize  the  population  exposed  or  be  able  to  evacuate 
persons  not  associated  with  the  hazard-generating  event.  This  is  in  accordance  with  the  primary 
policy  that  no  hazardous  condition  is  acceptable  if  mission  objectives  can  be  attained  from  a 
safer  approach,  methodology,  or  position  (i.e.,  minimizing  the  hazards  and  conducting  the 
mission  as  safely  as  reasonably  possible).  When  hazards  cannot  be  contained  or  minimized  to  an 
insignificant  level,  refined  assessments  are  performed  to  determine  if  the  remaining  risks  are 
acceptable.  An  additional  benefit  of  hazard  containment  is  that  this  process  is  typically  less 
costly  than  risk  assessments  and  can  be  evaluated  relatively  quickly  with  straightforward 
assumptions  and  with  less  required  data. 

2.3.1  Phase  I:  Mission  Definition  and  Hazard  Identification 

Phase  I  is  the  “problem  definition”  step  of  the  process.  Information  is  assembled  to 
identify  mission  characteristics,  objectives,  and  constraints.  Potential  hazard  sources  must  be 
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identified  by  evaluating  the  system  to  be  flown  and  the  range  safety  constraints.  Information 
sources  typically  include: 

a.  range  safety  data  packages; 

b.  system  description  documents; 

c.  MEP  and  COP  locations; 

d.  surrounding  population  data  to  include  public  and  commercial  facilities  and 

transportation  assets  (including  aircraft  corridors  and  shipping  lanes); 

e.  seasonal  meteorological  data; 

f.  the  range  safety  system  used; 

g.  lessons  learned  on  similar  missions. 

Further  details  of  information  sources  are  in  Chapter  2  and  Chapter  7  of  the  supplement 
to  this  document.  The  output  of  this  step  provides  a  basis  for  hazard  analysis  and  risk  assessment 
and  for  use  in  evaluating  options  for  mitigating  risks  in  ways  that  will  minimize  adverse  mission 
impact. 

2.3.2  Phase  II:  Risk  Assessment 

This  step  provides  information  needed  to  determine  whether  further  risk  reduction 
measures  are  necessary.  Risk  levels  for  identified  hazards  are  expressed  using  qualitative  and 
quantitative  methods.  This  step  produces  basic  measures  of  the  risks  posed  by  hazards.  These 
hazards  include  direct  hazards,  such  as  inert,  explosive,  and  flammable  debris  dispersions, 
explosive  overpressure  fields,  exposure  to  toxic  substances,  and  exposure  to  ionizing  and  non¬ 
ionizing  radiation.  They  also  include  possible  indirect  hazards  and  derivative  exposure  to  people 
that  could  arise  from  damage  to  infrastructure.  In  some  cases,  this  step  will  provide  sufficient 
information  to  support  the  decision  making  without  further  analysis. 

A  valid  risk  assessment  must  account  for  all  potential  hazards  posed  by  the  range  activity 
to  personnel,  facilities,  and  other  assets.  The  assessment  must  be  based  on  accurate  data, 
scientific  principles,  and  an  application  of  appropriate  mathematics.  The  assessment  must  be 
consistent  with  the  range  safety  control  that  is  planned  for  the  mission.  Valid  calculations  to 
assess  risk  can  be  made  using  the  methods  presented  in  the  supplement.  These  typically  produce 
conservative  estimates  (i.e.,  they  produce  a  scientifically  plausible  result  that  characteristically 
overestimates  risk  given  existing  uncertainties).  In  all  cases,  the  analyst  is  responsible  for 
ensuring  that  the  application  of  the  methods  in  the  supplement  produces  reasonable  results.  This 
assessment  leads  to  mitigation  measures  needed  to  protect  individuals  and  groups  of  people.  This 
topic  is  discussed  more  fully  in  Chapter  3. 

In  general,  risk  is  expressed  as  the  product  of  the  probability  of  occurrence  of  an  event 
and  the  consequences  of  that  event.  Total  risk  is  the  combination  of  the  products,  over  all 
possible  events,  of  the  probability  of  each  event  and  its  associated  consequence.  The  probability 
of  an  event  is  always  between  zero  and  one;  however,  the  consequences  of  that  event  can  be  any 
value.  Risk  can  be  relatively  high  if  the  probability  is  high,  or  the  consequence  is  great,  or  a 
combination  of  the  two. 
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Simple  risk  models  are  often  employed  to  make  an  initial  determination  of  risk.  They  are 
also  used  when  the  identified  hazards  are  known  to  result  in  low  risks  and  the  analyst  is  assured 
that  the  estimated  risk  is  conservative.  For  example,  simple  models  can  be  used  when  only  inert 
debris  occurs  and  the  debris  is  fairly  limited  in  size  and  weight  with  relatively  low  values  of 
kinetic  energy  or  ballistic  coefficients  and  shelters  would  provide  protection  from  debris.  These 
models  are  generally  less  costly,  minimize  schedule  impacts,  and  have  the  following 
characteristics. 

a.  Simplified  application  of  input  parameters  and  assumptions. 

b.  Simplified  measures  of  population  estimation  utilized. 

c.  A  basic  injury  model  and  associated  casualty  areas. 

d.  Conservative  assumptions  of  debris  fragmentation  and  survivability. 

If  the  resulting  risk  estimate  is  conservative  and  well  within  acceptable  limits,  then 
models  that  are  more  costly  and  time-consuming,  more  complex,  or  of  higher  fidelity  will  not  be 
necessary. 

When  the  identified  hazards  are  significant  or  the  initial  risk  estimate  shows  that 
acceptance  criteria  are,  or  may  be,  exceeded,  then  more  complex  risk  models  are  typically  used. 
Use  of  these  models  may  be  more  costly,  be  time-consuming  to  execute,  and  require  a  higher 
fidelity  and  more  sophisticated  application  of  input  data  and  assumptions.  The  assessment  may 
require  detailed  population  and  sheltering  models,  more  complex  human  vulnerability  models, 
and  more  realistic  debris  fragmentation  and  survivability  models.  This  may  require  input 
parameters  and  assumptions  to  be  supported  by  empirical  evidence  or  expert  elicitation  and 
quantification  of  the  impact  of  uncertainty  in  the  risk  model  and  model  parameters.  Complex  risk 
assessment  models  are  typically  used  when  significant  size  debris  or  explosive  debris  impacts  are 
present  that  could  compromise  shelters  and  the  associated  population. 

2.3.3  Phase  III:  Criteria  Comparison  and  Risk  Reduction 

Risk  measures  are  compared  with  criteria  to  determine  the  need  or  desirability  for  risk 
reduction.  If  the  risk  is  initially  unacceptable,  measures  should  be  considered  to  eliminate  or 
mitigate  it.  Elimination  is  achieved  by  design  or  system  changes  that  remove  the  hazard  source, 
such  as  replacing  a  hazardous  material  with  a  non-hazardous  one  or  moving  a  trajectory  to 
achieve  containment.  Mitigation  is  achieved  by  reducing  the  consequences  of  an  event  or  the 
probability  of  an  event  happening.  For  example,  increasing  system  reliability  of  a  launch  vehicle 
or  test  article  will  increase  the  probability  of  success,  thereby  lowering  risk.  Alternatively, 
designing  a  mission  to  avoid  flight  over  densely  populated  areas  will  decrease  consequences  of 
casualties  and  thereby  reduce  the  risk.  Mitigation  measures  may  include  elements  in  the 
operation  plan  that  reduce  risk  and  are  consistent  with  operational  objectives,  flight  termination 
systems  (FTSs),  containment  policies,  evacuation,  sheltering,  and  other  measures  to  protect 
assets  from  the  hazards.  Flight  termination  criteria  and  mission  rules  should  be  reviewed  to 
assure  that  the  risks  induced,  should  they  be  exercised,  are  tolerable.  To  evaluate  the 
effectiveness  of  mitigation  measures,  risk  must  be  reassessed  assuming  they  have  been 
implemented.  These  risk  reduction  procedures  should  be  followed  until  risk  levels  are  as  low  as 
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reasonably  practical.9 10  See,  for  example,  the  waiver  of  debris  containment  requirements  for 
launch  granted  by  the  Federal  Aviation  Administration  (FAA)  as  documented  in  the  Federal 
Register. 

2.3.4  Phase  IV :  Risk  Acceptance 

Presentations  to  the  decision  authority  must  be  sufficient  to  support  an  informed  decision. 
The  presentations  should  include  all  range-mandated  risk  control  measures,  residual  risks, 
measures  of  catastrophic  loss  potential  (such  as  collective  risk  given  a  flight  termination  action, 
collective  risk  given  failure  of  an  FTS,  and  risk  profiles),  key  analysis  assumptions,  the  size  and 
impact  of  uncertainties  in  the  analysis,  and  the  protective  measures  that  have  been  considered 
and  implemented  and  their  effectiveness.  The  decision  authority  must  approve  proposed  mission 
rules  and  should  compare  the  operational  risk  to  the  criteria  defined  in  this  document  and  to  other 
applicable  mission  requirements.  When  local  agreements  are  in  place  and  the  range  has 
adequately  communicated  the  content  and  rationale  of  this  document  to  the  representatives  of 
local  government,  local  agreements  should  govern.  This  shall  not  be  interpreted  as  overriding 
any  federal  or  state  laws  or  regulations.  The  three-tiered  hierarchy  of  requirements  is: 

a.  Federal  and  state  laws  and  regulations; 

b.  Local  agreements; 

c.  This  document. 

In  general,  higher-risk  operations  require  a  higher  level  of  approval.  The  range 
commander  may  tolerate  risk  levels  within  criteria  given  herein  to  secure  certain  benefits  from  a 
range  activity  with  the  confidence  that  the  risk  is  properly  managed  and  consistent  with  best 
practices.  The  outcome  of  these  presentations  to  the  decision  authority  is  the  acceptance  of 
operational  risks  by  a  properly  informed  decision  authority.  This  acceptance  includes  a 
determination  that  the  residual  operational  risk  is  within  tolerable  limits.  By  doing  so,  it  avers/ 
justifies  that  the  proposed  conditions  for  allowing  the  operation  to  be  initiated  and  the  rules  to 
allow  the  mission  to  continue  to  completion  comply  with  best  practices  for  ensuring  that  the  risk 
is  less  than  accepted/tolerable  levels. 

The  terms  of  this  acceptance  and  required  implementation  conditions  must  be 
documented.  The  responsible  safety  office  should  document  a  risk  assessment  to  demonstrate 
compliance  with  the  risk  management  policy  applied. 

2.3.5  Risk  Management  for  Public  Infrastructure— 

The  risk  management  process  described  in  the  previous  subsections  is  maintained  for 
public  infrastructure;  however,  it  is  accomplished  using  the  two-tiered  methodology  shown  in 
Figure  2-2  because,  in  contrast  to  injury  to  people,  damage  to  infrastructure  must  be  evaluated  at 
both  the  unit  component  level  and,  following  that,  at  the  system  level.  The  colors  of  the  steps  in 


9  Federal  Aviation  Administration.  “Waiver  of  Debris  Containment  Requirements  for  Launch.”  Notice  of  Waiver. 
Federal  Register,  Vol.  81,  No.  7.  12  January  2016.  Available  at 

https://www.federalregister.gov/articles/2016/01/12/2016-00444/waiver-of-debris-containment-requirements-for- 

launch. 

10  Some  of  the  details  in  this  subsection  may  be  moved  to  the  supplement  when  it  is  updated. 
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Figure  2-2  correspond  to  the  colors  used  in  Figure  2-1  for  the  phases  of  the  risk  management 
process. 


Figure  2-2.  Two-Tiered  Risk  Management  Process  for  Infrastructure 


a.  Tier  1  Consequence  Assessment.  A  Tier  1  consequence  assessment  is  an  initial,  and 
largely  qualitative,  assessment  performed  to  achieve  three  objectives: 

(1)  Enumerating  the  items  and  categories  of  public  infrastructure  to  which  a  mission 
constitutes  a  realistic  threat; 

(2)  Specifying  the  type  and  number  of  unit  components  of  each  item  of  infrastructure 
for  possible  vulnerability; 

(3)  Identifying  the  criticality  of  unit  component  functionality  to  the  larger  system-level 
functionality  and  possible  derivative  exposure  that  could  result  from  nominal  or  off- 
nominal  mission  occurrences. 

The  Tier  1  consequence  assessment  should  be  performed  using  Table  3-2  in  order  to 
ascertain  which  of  the  four  possible  maximum-consequence  severity  classes  could  result 
from  a  nominal  or  off-nominal  mission. 

b.  Tier  2  Consequence  Assessment.  A  Tier  2  consequence  assessment  follows  the  Tier  1 
assessment.  The  Tier  2  assessment  is  a  quantitative  assessment  of  the  probable  effects  of 
damage  to  the  set  of  public  infrastructure  unit  components  and  system  networks 
identified  as  requiring  protection  in  Tier  1.  The  Tier  2  assessment  uses  the  appropriate 
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vulnerability  flowcharts,  damage  severity  thresholds,  and  models  of  the  threats  to 
estimate  the  acceptability  criteria  identified  in  the  Tier  1  assessment  process  for  each  of 
the  applicable  infrastructure  types. 

2.3.6  Conditional  Risk  Management 

Flight  termination  action  is  a  good  example  of  a  risk-mitigating  safety  intervention  that 
induces  a  conditional  risk  that  should  be  managed.  A  conditional  risk  management  process 
should  be  implemented  to  assure  that  mission  rules  and  flight  termination  criteria  do  not  induce 
unacceptable  levels  of  risk  when  they  are  implemented. 1 1  This  review  process  is  outlined  in  the 
supplement  in  Chapter  2.  Figure  2-3  shows  the  relationship  between  the  risk  management 
process  just  outlined  and  the  conditional  risk  management  process. 


Figure  2-3.  Relationship  Between  Conditional  Risk  Management  and 

Basic  Risk  Management 


2.4  Uncertainty  in  the  Computed  Risk 

The  RSG  RC  recognizes  that  there  is  significant  uncertainty  in  the  computed  risks  of 
rocket  launches.  Confidence  bounds  of  90%  describing  the  uncertainty  in  the  computed  risk  can 
have  a  range  of  several  orders  of  magnitude.  For  this  reason,  uncertainty  cannot  be  ignored; 
however,  it  is  not  necessary  to  deal  with  uncertainty  if  the  estimate  of  the  expected  casualties 
(Ec)  or  expected  fatalities  (Ef)  is  so  small  that  even  with  a  large  uncertainty  the  true  risk  is 
unlikely  to  challenge  the  acceptability  criterion.  The  RC  has  introduced  a  process  whereby  the 
uncertainty  does  not  have  to  be  considered  if  the  computed  risk  is  less  than  one-third  of  the 


11  The  FAA  referenced  this  in  the  waiver  of  debris  containment  requirements  for  launch  it  as  documented  in  the 
Federal  Register  Vol.  81,  No.  7,  12  January  2016,  p.1470 
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primary  aggregated  collective  risk  criterion.12  On  the  other  hand,  if  the  risk  level  does  not  pass 
this  test,  the  range  should  compute  the  uncertainty  to  assure  that  a  launch  is  not  allowed  that 
would  violate  the  criterion  based  on  best  estimates  that  account  for  uncertainty.  The  decision 
process  regarding  risk  acceptability  under  uncertainty  is  shown  in  the  flowchart  in  Figure  2-4. 


Standard  vehicle,  mission, 
meteorological,  population 
and  range  safety  criteria  data 


Risk  analysis  programthat  is  at 
the  standard  established  in  the 
Supplement  to  RCC  321-10 


Compute  Ec 
(without 
uncertainty) 


I  Note  that  the  procedure  presented 
i  here  is  equally  applicable  to  the 
|  treatment  of  EF 


RCC  321 -10 

acceptability  criteria  for 
collective  risk- AC 


Apply  risk  mitigations 
such  as  movement  of 
population,  sheltering  of 
population,  etc. 


yes 

r  19  _rs  1 1 0  ttw  ! 

no 

Recompute  Ec 

> 

Acceptable 

after  mitigations 

to  proceed 

have  been  applied 

or  iterate 


Epistemic  uncertainties 
in  the  model  and  the  data 
entered  into  the  risk 
analysis  computation 


Legend 


Input  data 


Acomputational 
process  or  action 


Criteria  or  guidance 
from  RCC321 


Final  outcome 


Quantify  the 
uncertainty  in  the  Ec 
computation  and 
determine  ‘true’ 
Ec(ave.)  (including 
adjustment  for  bias) 

T 


The  order  of  mitigation  first  and 
uncertainty  quantification  second 
allows  a  range  that  has  difficulty 
quantifying  uncertainty  to  bypass 
the  process  as  long  as  the  Ec  is 
less  than  1/3  AC.  The  option  to  go 
through  the  uncertainty  process 
first  can  possibly  save  costly 
mitigations  if  the  average  Ec 
considering  uncertainty  is  satisfied. 


Uncertainty  computation 
guidelines  in  Chapter4 
ofthe  RCC  321-10 
supplement 


Acceptable 
to  proceed 


Redesign  mission 
orgo  to  a  higher 
authority 


1  Aprecedentforthe  use  of  1/3  AC 
J  is  in  Par.  A4.4.2.2  of  AFSPCMAN 
i  91-710.  See  footnote  on  previous 
'  page. 


Figure  2-4.  Flow  Diagram  for  the  Launch  Risk  Acceptability  Process 

Considering  Uncertainty 


12  The  choice  of  1/3  is  consistent  with  the  recommendation  in  AFSPCMAN  91-710VI,  1  July  2004,  which  uses 
30xl0'6  as  the  acceptability  criterion  for  casualty  expectation.  In  the  range  between  10  and  30x10  6  (equivalent  to 
one  third  of  the  risk  criterion),  AFSPCMAN  91-710V1,  Attachment  4,  page  1 1  states 
“A4.4.2.2.  Hazard  Risks  >10  through  30  in  1,000,000  (Ec  >  10x10  6  through  30xl0-6).  This  level  of  risk  may 
require  the  Range  User  to  take  additional  measures  to  protect  personnel  and  resources.  Examples  include  fix/ 
correct/improve  existing  noncompliances,  improve  risk  analyses  to  reduce  the  level  of  uncertainty,  require  day-of- 
launch  risk  analyze,  establish  disaster  aversion  criteria.  Range  Safety  is  the  approval  authority  for  risks  >10  through 
30  in  1,000,000  (Ec  >  10xl0“6  through  30xl0“6).” 
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CHAPTER  3 

Acceptable  Risk  Criteria 

This  chapter  defines  acceptable  risk  criteria  for  people,  aircraft,  ships,  and  spacecraft  that 
may  be  exposed  to  hazards  associated  with  range  flight  operations.  It  also  includes  provisional 
acceptable  risk  criteria  for  public  infrastructure.  Hazard  thresholds  for  people,  aircraft,  and  ships 
are  provided  in  Chapter  6  of  the  supplement. 

There  are  two  major  components  of  the  risk  acceptability  criteria:  a  set  of  performance 
standards  for  establishing  and  implementing  appropriate  risk  criteria  at  a  range,  followed  by  a  set 
of  quantitative  standards.  The  quantitative  risk  criteria  contained  in  this  chapter  prescribe  limits 
on  a  per-mission  and  an  annual  basis.  The  per-mission  requirements  are  intended  to  apply 
separately  to  launch  and  reentry  missions  as  defined  in  the  glossary.  Chapter  4  of  the  supplement 
provides  guidelines  for  establishing  a  risk  budget  for  complex  missions,  such  as  those  that 
involve  multiple  launches  or  distinct  phases  of  flight.  Chapter  4  also  provides  guidelines  for 
implementation  of  these  criteria,  including  annual  risk  management,  catastrophe  aversion,  and 
protection  of  ships,  aircraft,  and  manned  spacecraft. 

3.1  Performance  Standards 

Each  range  must  perform  the  following. 

a.  Assess  the  risk  to  all  people  from  launch  and  reentry  activities  in  terms  of  hazard  severity 
and  mishap  probability.  Note:  Hazardous  operations  that  can  be  contained  within  a 
controlled  area  may  not  require  a  risk  assessment. 

b.  Estimate13  the  Ec  associated  with  each  activity  that  falls  within  the  scope  of  this 
document.  Additional  risk  measurements  may  be  useful  for  range  operations  that  are 
dominated  by  fatality  to  ensure  fatality  risks  do  not  exceed  acceptable  limits. 

c.  Document  its  measure(s)  of  risk  and  risk  acceptability  policy  in  local  requirements  and 
policy  documentation. 

d.  Maintain  documentation  to  demonstrate  that  its  risk  measures  provide  a  complete  and 
accurate  assessment  of  the  risks,  to  include  documentation  needed  to  demonstrate  that  its 
risk  measures: 

(1)  clearly  convey  the  risk  for  decision  makers; 

(2)  are  consistent  with  the  measures  used  by  other  scientific  or  regulatory  communities 
involved  in  “comparable  involuntary  activities”  (as  described  in  Subsection  2.2,1). 

e.  Estimate  the  risk  on  a  per-mission  basis,  except  under  special  conditions  where  risk 
management  on  an  annual  basis  is  justified  as  described  below. 

f.  Periodically  conduct  a  formal  review  to  ensure  that  its  activities  and  its  mission  risk 
acceptability  policy  are  consistent  with  the  annual  risk  acceptability  criteria. 


13  The  overall  process  is  a  risk  assessment,  but  a  particular  value  (i.e.,  a  point  estimate)  is  referred  to  as  an  estimate. 
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3.2  Personnel  Protection 

3.2.1  General  Public 

a.  Individual  Risk  Criteria.  Individuals  must  not  be  exposed  to  a  probability  of  casualty 
greater  than  IE-6  for  any  single  mission.14  If  fatality  risks  are  also  incorporated  into  the 
risk  management  process,  then  individuals  must  not  be  exposed  to  a  probability  of  fatality 
greater  than  0.1E-6  (IE-7)  for  any  single  mission. 

b.  Collective  Risk  Criteria.  Collective  risk  for  the  GP  must  not  exceed  a  casualty 
expectation  of  100E-6  (IE-4)  for  any  single  mission.14  If  annual  risk  is  measured, 
collective  risk  for  the  GP  should  not  exceed  a  casualty  expectation  of  3000E-6  (3E-3)  on 
an  annual  basis.15  Risk  management  using  only  an  annual  measure  of  collective  risk  is 
only  justified  for  range  operations  that  occur  frequently  and  pose  low16  risk  on  a  per¬ 
mission  basis.  If  fatality  risks  are  also  incorporated  into  the  risk  management  process, 
then  the  collective  risk  for  the  GP  must  not  exceed  30E-6  (3E-5)  Ef  for  any  single 
mission.  If  risk  management  using  only  annual  risks  is  justified,  and  fatality  risks  are  also 
incorporated  into  the  risk  management  process,  then  the  collective  risk  for  the  GP  must 
not  exceed  1000E-6  (IE-3)  Ef  on  an  annual  basis. 

c.  Catastrophic  Risk  Criteria.  Catastrophic  risk  for  the  GP 17  should  not  exceed  the 
provisional18  criteria  outlined  in  Subsection  3.7.3. 

3.2.2  Mission-Essential  and  Critical  Operations  Personnel 

a.  Individual  Risk  Criteria.  Individual  MEP  and  individual  COP  must  not  be  exposed  to  a 
probability  of  casualty  greater  than  10E-6  (IE-5)  for  any  single  mission.  If  fatality  risks 
are  also  incorporated  into  the  risk  management  process,  then  individual  MEP  and  COP 
must  not  be  exposed  to  a  probability  of  fatality  greater  than  IE-6  for  any  single  mission. 

b.  Collective  Risk  Criteria.  Collective  risk  for  MEP  and  COP  must  not  exceed  a  casualty 
expectation  of  300E-6  (3E-4)  for  any  single  mission.  If  annual  risk  is  measured, 
collective  risk  for  MEP  and  COP  must  not  exceed  a  casualty  expectation  of  30000E-6 
(3E-2)  on  an  annual  basis.15  Risk  management  using  only  an  annual  measure  of 
collective  risk  is  only  justified  for  range  operations  that  occur  frequently  and  pose  low16 
risk  on  a  per-mission  basis.  If  fatality  risks  are  also  incorporated  into  the  risk 
management  process,  then  collective  risk  for  MEP  and  COP  must  not  exceed  an  expected 
number  of  fatalities  of  300E-6  (3E-4)  for  any  single  mission.  If  risk  management  using 
only  annual  risks  is  justified,  and  fatality  risks  are  also  incorporated  into  the  risk 
management  process,  then  the  collective  risk  for  MEP  and  COP  should  not  exceed 
10000E-6  (IE-2)  Ef  on  an  annual  basis. 


14  If  a  flight  operation  creates  a  toxic  risk,  then  the  range  must  separately  ensure  the  allowable  level  of  risk  enforced 
by  them  does  not  exceed  other  standards  for  toxic  exposure  limits  for  the  public  when  appropriate  mitigations  are  in 
place.  Chapter  8  of  the  supplement  provides  an  approach  for  implementing  this  requirement. 

15  Chapter  4  of  the  supplement  provides  guidelines  to  assist  in  the  implementation  of  annual  risk  management. 

16  In  this  context,  “low  risk”  means  approximately  two  orders  of  magnitude  below  the  per-flight  criteria  for 
collective  and  individual  risks. 

17  This  includes  people  in  any  transportation  system,  such  as  ships  and  aircraft,  as  described  in  Chapter  4  of  the 
supplement. 

18  The  RC  intends  to  investigate  this  further  and  the  criteria  are  subject  to  change  in  the  future. 
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c.  Catastrophic  Risk  Criteria.  Catastrophic  risk  for  MEP  and  COP  should  not  exceed  the 
provisional  criteria  outlined  in  Subsection  3.7.4. 

3.3  Aircraft  Protection19 

3.3.1  Non-Mission  Aircraft  Criteria 

a.  Non-Mission  Aircraft  Hazard  Volumes.  Non-mission  aircraft  will  be  restricted20  from 
hazard  volumes  of  airspace  where  the  cumulative  probability  of  impact  of  debris  capable 
of  causing  a  casualty  on  an  aircraft21  exceeds  0.1E-6  (IE-7)  for  all  non-mission  aircraft. 
As  an  alternative  to  protecting  against  a  probability  of  impact,  non-mission  aircraft  will 
be  restricted  from  hazard  volumes  that  exceed  the  individual  risk  criteria  given  in  a  of 
Subsection  3.2.1  and  the  catastrophe  criterion  given  in  Subsection  3.7.3.22 

b.  Non-Mission  Aircraft  Risk  Criteria.  The  individual  and  collective  risks  posed  to  the  GP 
in  any  aircraft  must  comply  with  the  criteria  given  in  Subsection  3.2.1. 

3.3.2  Mission-Essential  Aircraft  Criteria 

a.  Mission-Essential  Aircraft  Hazard  Volumes.  Mission-essential  aircraft  will  be  restricted20 
from  hazard  volumes  of  airspace  where  the  cumulative  probability  of  impact  of  debris 
capable  of  causing  a  casualty  on  an  aircraft  exceeds  IE-6  for  all  mission-essential 
aircraft.  As  an  alternative  to  protecting  against  a  probability  of  impact,  mission-essential 
aircraft  will  be  restricted  from  hazard  volumes  that  exceed  the  individual  risk  criteria 
given  in  a  of  Subsection  3.2.2  and  the  catastrophe  criterion  given  in  Subsection  3.7.4. 

b.  Mission-Essential  Aircraft  Risk  Criteria.  The  individual  and  collective  risks  posed  to 
MEP  in  any  aircraft  must  comply  with  the  criteria  given  in  Subsection  3.2.2. 

3.3.3  Aircraft  Hazard  Volumes  for  Planned  Debris  Releases 

The  range  must  confirm  that  Notices  to  Airmen  are  issued  that  encompass  the  volume 
and  duration  necessary  to  protect  aircraft  from  debris  capable  of  causing  an  aircraft  accident  due 
to  all  planned  events.23 


19  Chapter  4  of  the  supplement  provides  important  guidelines  on  the  proper  implementation  of  aircraft  protection 
measures. 

20  In  this  context  restricted  from  means  that  the  range  will:  (1)  ensure  that  appropriate  warnings/restrictions  are 
issued  through  the  FAA;  and  (2)  not  proceed  with  the  hazardous  activity  if  the  range  has  knowledge  that  any  aircraft 
hazard  volume  is  violated. 

21  Chapter  6  of  the  supplement  provides  threshold  values  to  help  define  such  debris. 

22  The  supplement  explains  how  hazard  areas  can  be  defined  using  probability  of  impact  values  and  demonstrate 
compliance  with  Subsection  3.3.1  for  non-mission  aircraft  or  Subsection  3.3.2  for  mission-essential  aircraft.  A  range 
may  prefer  to  use  other  methods  that  demonstrate  compliance  with  the  individual  and  collective  risk  criteria.  In  any 
case,  the  individual  and  collective  risk  criteria  requirements  always  apply  to  all  people,  regardless  of  transportation 
mode. 

23  Planned  debris  releases  include  intercept  debris,  jettison  stages,  nozzle  covers,  fairings,  inter-stage  hardware,  etc. 
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Federal  law24  defines  an  aircraft  accident  as  “an  occurrence  associated  with  the 
operation  of  an  aircraft  which  takes  place  between  the  time  any  person  boards 
the  aircraft  with  the  intention  of  flight  and  all  such  persons  have  disembarked, 
and  in  which  any  person  suffers  death  or  serious  injury,  or  in  which  the  aircraft 
receives  substantial  damage.”  As  described  in  the  glossary,  federal  law  also 
defines  death,  serious  injury,  and  substantial  damage  for  the  purposes  of 
accident  reporting. 


3.3.4  Mishap  Response 

The  range  must  coordinate  with  the  FAA  to  ensure  timely  notification25  of  any  expected 
air  traffic  hazard  associated  with  range  activities.  In  the  event  of  a  mishap,  the  range  must 
immediately  inform  the  FAA  of  the  volume  and  duration  of  airspace  where  an  aircraft  hazard  is 
predicted. 


3.4  Ship  Protection26 

The  term  “ship”  includes  boats  and  watercraft  of  all  sizes. 

3.4.1  Non-Mission  Ship  Criteria 

a.  Ship  Warning  Areas.  Notices  to  Mariners  (NOTMARs)  shall  be  issued  to  warn  non¬ 
mission  ships  of  regions  defined  by  one  of  the  following  approaches:27 

(1)  where  the  probability  of  debris  capable  of  causing  a  casualty  impacting  on  or  near  a 
vessel  exceeds  10E-6  ( IE— 5),  accounting  for  all  relevant  hazards;  or 

(2)  the  union  of  the  areas  where  the  individual  probability  of  casualty  for  any  person 
onboard  exceeds  the  criteria  in  a  of  Subsection  3.2.1,  the  collective  casualty 
expectation  for  an  individual  ship  would  exceed  the  criterion  in  b  of  Subsection 
3.2.1,  and  the  catastrophic  risk  for  an  individual  ship  would  exceed  the  provisional 
criteria  outlined  in  Section  3.7. 

In  some  situations,  warnings  may  be  optional  when  expected  ship  traffic  in  the  affected 
area  is  low  and  adequate  observation  will  be  performed. 

b.  Non-Mission  Ship  Risk  Criteria.  People  on  observed  non-mission  ships  shall  be 
included28  in  the  determination  of  compliance  with  collective  risk  criteria  in  b  of 
Subsection  3.2.1  and  provisional  catastrophic  criteria  in  c  of  Subsection  3.2.1. 
Observation  to  locate  non-mission  ships  is  an  acceptable  method  to  ensure  compliance, 
provided  that  suitable  observation  techniques  are  used  to  include  the  region(s): 

(1)  where  the  individual  probability  of  casualty  exceeds  the  criteria  in  a  of  Subsection 
3.2.1;  and 


24  49  C.F.  R.  830.2.  1  October  2011. 

25  This  may  be  accomplished  through  preflight  analyses  and  coordination  as  described  in  Chapter  4  of  the 
supplement. 

26  Chapter  4  of  the  supplement  provides  important  guidelines  on  the  proper  implementation  of  ship  protection 
measures. 

27  The  warning  area  may  be  expanded  to  provide  additional  mitigation  so  that  risk  criteria  (3.2.1)  are  met,  as 
discussed  in  Chapter  4  of  the  supplement. 

28  Mission  risk  shall  include  all  members  of  the  GP  on  land,  on  ships,  and  on  aircraft. 
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(2)  where  the  collective  casualty  expectation  or  provisional  catastrophic  risk  criteria  (b 
or  c  of  Subsection  3.2.1,  respectively)  would  be  exceeded  given  a  conservative 
estimate  of  typical  ship  traffic. 

3.4.2  Mission-Essential  Ship  Criteria 

a.  Mission-Essential  Ship  Hazard  Areas.  Mission-essential  ships  will  be  restricted  from 
hazard  areas  defined  by  either: 

(1)  the  region  where  the  probability  of  debris  capable  of  causing  a  casualty  impacting 
on  or  near  a  vessel  exceeds  100E-6  (IE-4),  accounting  for  all  relevant  hazards;  or 

(2)  The  union  of  the  areas  where  the  individual  probability  of  casualty  for  an  exposed 
person  onboard  exceeds  the  criteria  in  a  of  Subsection  3.2.2,  the  collective  risk 
criteria  in  b  of  Subsection  3.2.2,  or  the  catastrophic  risk  criteria  in  c  of  Subsection 
3.2.2. 

b.  Mission-Essential  Ship  Risk  Criteria.  Ship-board  MEP  shall  be  included  in  the 
assessment  of  compliance  with  the  collective  risk  criteria  in  b  of  Subsection  3.2.2  and 
catastrophic  risk  criteria  in  c  of  Subsection  3.2.2. 

3.4.3  Ship  Hazard  Areas  for  Debris  Releases 

The  range  must  confirm  that  NOTMARs  are  issued  for  each  planned  debris  release  event 
that  encompasses  the  areas  and  durations  necessary  to  satisfy  the  risks  as  described  in  a  of 
Subsection  3.4.1  or  contain,  with  99%  probability  of  containment,  all  resulting  debris  impacts 
capable  of  causing  a  casualty.29 

3.4.4  Mishap  Response 

The  range  must  coordinate  with  the  United  States  Coast  Guard  or  other  appropriate 
authorities  to  ensure  timely  notification  of  any  ship  traffic  hazard  associated  with  range 
activities.  In  the  event  of  a  mishap,  the  range  must  promptly  inform  the  appropriate  authority(s) 
of  the  area  and  duration  of  navigable  waters  where  a  ship  hazard  is  predicted. 

3.5  Infrastructure  Protection 

3.5.1  Mission-Essential  Infrastructure  Criteria 

Mission-essential  infrastructure  (such  as  radar  equipment)  is  treated  separately  as  critical 

assets. 

3.5.2  Non-Mission  Public  Infrastructure  Criteria— 

Damage  severity  for  infrastructure  is  currently  defined  beginning  at  the  unit  component 
level,  for  all  types  of  infrastructure  according  to  the  definitions  in  Table  3-1. 31 


29  This  99%  probability  of  containment  region  corresponds  to  a  3-sigma  dispersion  region  for  a  single  impact  if  the 
impact  uncertainty  can  be  characterized  by  a  bivariate  normal  impact  probability  distribution. 

30  Some  of  the  details  in  this  subsection  may  be  moved  to  the  supplement  when  it  is  updated. 

31  A  unit  component  is  the  minimal  set  or  collection  of  equipment  that  is  necessary  to  fulfill  the  basic  functions 
required  of  the  infrastructure  to  be  protected.  As  an  example,  for  a  wind  turbine  farm,  the  unit  component  would  be 
a  single  wind  turbine.  A  unit  component  can  be  considered  analogous  to  a  single  person  (individual). 
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Table  3-1.  Severity  Level  Definitions 

Damage  Level 

Definitions 

Associated  Damage  Index 

No  Damage 

Component  functions  without  repair 

o  i 

Regular  Repair 

Item  can  be  repaired  by  a  “reasonable 
competent  mechanic”  working  with 
“basic  set  of  tools” 

1  Onset  of  regular  repair 

2  Regular  repair  damage  assured 
(“significant”  repair  time  is 
required) 

Special  Repair 
Damage 

Item  can  be  repaired  by  “specially 
trained  mechanic”  working  with  a 
“special  set  of  tools” 

3  Onset  of  specialized  repair  damage 

4  Specialized  repair  damage  assured 

Total  Damage 

Item  is  beyond  repair 

5  Total  damage 

There  are  two  operational  severity  categories  of  interest  in  Table  3-1:  damage  severity 
level  (DSL)  2  and  DSL  5.  Protection  to  infrastructure  is  achieved  by  limiting  the  probability  of 
DSL  2  to  unit  components  and  the  cumulative  probability  to  a  critical  number  of  unit 
components  being  damaged  at  this  level  or  greater.32  In  addition,  higher- fidelity  analyses  will 
consider  a  systematic  assessment  of  the  severity  of  the  maximum  system-level  consequences  that 
could  plausibly  result  due  to  unit  component  damage  along  with  cascading  damage  to  secondary 
infrastructure  or  possibly  derivative  exposure  to  people. 

Table  3-2  lists  provisional33  protection  criteria  for  public  infrastructure  located  on  or 
nearby  base  installations.  The  criteria  are  a  function  of  the  level  of  consequences  to  the 
infrastructure  system.  Four  consequence  categories  are  defined  for  Tier  1  assessment  depending 
on  the  severity  and  spatial  extent  of  the  damage.  Risk-informed  criteria  are  proposed  for  less- 
severe  consequences,  while  physical  separation  of  the  protected  assets  from  a  hazard 
containment  area  is  recommended  for  events  with  more  severe  consequences,  where  the  hazard 
containment  area  is  defined  by  the  allowable  probability  of  impact  contour. 

a.  Risk-Informed  Criteria 

(1)  Nuisance  to  infrastructure  should  be  protected  on  a  unit  component  basis  to  ensure 
the  probability  of  DSL  2  is  less  than  or  equal  to  1000E-6  (IE-3),  unless  a  hazard 
containment  criterion  is  applied.34 

(2)  Elective  repair  to  infrastructure  should  be  protected  on  a  unit  component  basis  to 
ensure  the  probability  of  DSL  2  is  less  than  or  equal  to  100E-6  (IE-4),  unless  a 
hazard  containment  criterion  is  applied.35 


32  These  two  categories  may  be  qualitatively  interpreted  as  analogous  to  human  casualty  and  fatality. 

33  The  RC  intends  to  investigate  this  further  and  the  criteria  are  subject  to  change  in  the  future. 

34  Nuisance  includes  damage  comparable  in  terms  of  maximum  severity  of  consequences  to  normal  background 
damaging  events  (such  as  lighting,  malicious  vandalism  from  firearms)  that  can  be  repaired  as  part  of  the  routine 
maintenance  program  for  the  infrastructure. 

35  Elective  repair  includes  damage  that  does  not  preclude  the  operation  of  the  infrastructure  and  can  be  repaired  as 
part  of  the  routine  maintenance  program  for  the  infrastructure;  however  operation  may  be  on  a  reduced  schedule  or 
capacity,  and  on-going  monitoring  is  generally  required. 
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(3)  Mandatory  repair  to  infrastructure  should  be  protected  on  a  unit  component  basis  to 
ensure  the  probability  of  DSL  2  is  less  than  or  equal  to  10E-6  (IE-5),  unless  a 
hazard  containment  criterion  is  applied.36 

(4)  Severe  system  consequences  would  normally  be  protected  using  the  hazard 
containment  criteria  in  b  of  Subsection  3,5,2;  however,  if  warranted,  a  risk- 
informed  criterion  can  be  used,  provided  protection  on  a  unit  component  basis 
ensures  the  probability  of  DSL  2  is  less  than  or  equal  to  IE-6. 

b.  Hazard  Containment  Criteria 

(1)  Nuisance  to  infrastructure  should  be  protected  on  an  exclusion-area  basis  such  that 
the  cumulative  probability  of  DSL  2  or  greater  to  the  critical  number  of  unit 
components  is  less  than  or  equal  to  1000E-6  (IE-3),  unless  the  risk-based  criterion 
in  a  of  Subsection  3,5,2  is  applied. 

(2)  Elective  repair  to  infrastructure  should  be  protected  on  an  exclusion-area  basis  such 
that  the  cumulative  probability  of  DSL  2  or  greater  to  the  critical  number  of  unit 
components  is  less  than  or  equal  to  100E-6  (IE-4),  unless  the  risk-based  criterion 
in  a  of  Subsection  3,5,2  is  applied. 

(3)  Mandatory  repair  to  infrastructure  should  be  protected  on  an  exclusion-area  basis 
such  that  the  cumulative  probability  of  DSL  2  or  greater  to  the  critical  number  of 
unit  components  is  less  than  or  equal  to  10E-6  (IE-5),  unless  the  risk-based 
criterion  in  a  of  Subsection  3,5,2  is  applied. 

(4)  Severe  system  consequences  to  infrastructure  should  be  protected  on  an  exclusion- 
area  basis  such  that  the  cumulative  probability  of  DSL  2  or  greater  to  the  critical 
number  of  unit  components  is  less  than  or  equal  to  IE-6,  unless  the  risk-based 
criterion  in  a  of  Subsection  3,5,2  is  applied. 


36  Mandatory  repair  includes  damage  that  precludes  the  operation  of  a  complete  unit  component  or  infrastructure 
system  and  requires  an  unscheduled  and  generally  immediate  maintenance  action  to  repair  it. 
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Table  3-2.  Provisional  Risk  Assessment  Matrix  for  Public  Infrastructure 

Severity 

Vulnerability  N. 

Severe  System  Consequences 

•  Significant  cost  to  repair,  or 

•  Potential  derivative  exposure, 
and 

•  External  authority 
involvement 

•  Potential  cascading 
consequences 

Mandatorv  Repair  with 

•  Minimal  social/political 
consequences,  and 

•  Local  authority  involvement, 
and 

•  Consequences  are  confined 

Elective  Repair  with 

•  Minimal  social/political 
consequences,  and 

•  No  accident/environmental 

assessments 

•  Consequences  are  confined 

Nuisance  to 

•  Infrastructure,  people  or  range 
ops 

•  Consequences  are  confined 
and  acceptable  to  government 
&  developers/operators 

•  Prompt  easily 
assessed  damage,  or 

•  Immediate  derivative 
exposure  to  people 

Pr(UCi  >  DSL  2)  <  1  x  10-6, 
or  exclude  infrastructure  from 
the  region  where  the  cumulative 
probability  of  DSL  2  or  greater 
to  the  critical  number  of  unit 
components  is  greater  than  1  x 

10“6 

PrQJCi  >  DSL  2)  <  1  x  10-5, 
or  exclude  infrastructure  from 
the  region  where  the  cumulative 
probability  of  DSL  2  or  greater 
to  the  critical  number  of  unit 
components  is  greater  than  1  x 
1(T5 

Pr(UCi  >  DSL  2)  <  1  x  10-4, 
or  exclude  infrastructure  from 
the  region  where  the  cumulative 
probability  of  DSL  2  or  greater 
to  the  critical  number  of  unit 
components  is  greater  than  1  x 

1(T4 

PrQJCi  >  DSL  2)  <  1  x  10-3, 
or  exclude  infrastructure  from 
the  region  where  the  cumulative 
probability  of  DSL  2  or  greater 
to  the  critical  number  of  unit 
components  is  greater  than  1  x 

1(T3 

|  |  Exclusion  area  risk  criteria  |  Risk  informed  acceptance  criteria 
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3.6  Spacecraft  Protection 

Manned  spacecraft  and  those  on  route  to,  and  in  support  of,  manned  missions  shall  be 
protected  by:  (1)  not  exceeding  a  probability  of  impact  greater  than  IE-6  per  spacecraft;  or  (2) 
ensuring  an  ellipsoidal  miss-distance  of  200  km  in-track  and  50  km  cross  track  and  radially;  or 
(3)  ensuring  a  spherical  miss-distance  of  200  km.  A  spacecraft  is  considered  manned  if  it  is 
currently  occupied,  or  on  route  to,  and  in  support  of  manned  missions. 

These  three  protection  options  are  listed  in  the  order  of  preference,  with  Option  1 
providing  the  highest  level  of  protection.  Option  1  requires  a  covariance  matrix  as  input  to 
JSpOC  while  the  other  two  options  use  the  nominal  trajectories. 

The  second  option  of  an  ellipsoidal  miss-distance  is  preferred  over  a  spherical  miss- 
distance  because  the  largest  uncertainty  is  in  the  in-track  dimension. 

For  objects  (including  launch  vehicle,  payload,  jettisoned  components,  or  planned  debris) 
launched  into  a  sustainable  orbit,  the  duration  of  the  conjunction  assessment  required  for  manned 
and  active  spacecraft  protection  shall  be  applied  from  launch  through  orbit  insertion  plus  an 
appropriate  number  of  revolutions  to  account  for:  (1)  the  type  orbit  the  vehicle  or  component  is 
injected  into,  operating  in,  or  passing  through;  (2)  the  altitudes  where  manned  spacecraft  may  be 
in  orbit  and  the  appropriate  miss-distance;  and  (3)  a  sufficient  time  for  the  object  to  be 
catalogued.  This  time  shall  not  be  less  than  3  hours  after  liftoff  without  prior  coordination  with 
the  JSpOC  to  allow  an  earlier  time  for  the  object  to  be  catalogued.  Besides  the  launch  vehicle 
and  payload,  conjunction  assessments  must  include  all  components  jettisoned  during  the  launch 
and  intentionally  propagated  debris. 

Advisory  Requirement:  Active  spacecraft  other  than  manned  spacecraft  should  be 
protected  by  one  of  the  following  criteria  (listed  in  the  order  of  preference):  (1)  not  exceeding  a 
probability  of  impact  greater  than  IE-4  per  spacecraft;  or  (2)  ensuring  an  ellipsoidal  miss- 
distance  of  25  km  in-track  and  7  km  cross  track  and  radially;  or  (3)  ensuring  a  spherical  miss- 
distance  of  25  km. 

The  vulnerability  of  the  spacecraft  must  be  accounted  for  in  the  risk  assessment  and  the 
minimum  debris  size  hazardous  to  the  spacecraft  ascertained  from  the  spacecraft  operator 
whenever  practicable.  Otherwise,  the  spacecraft  should  be  considered  vulnerable  to  the  current 
minimum  debris  size  of  1  millimeter  or  greater. 

3.7  Catastrophic  Risk  Protection 

Catastrophic37  risk  criteria  are  designed  to  protect  against  scenarios  involving  numerous 
casualties.  The  following  provisional  catastrophic  risk  criteria  are  suggested  guidelines  to 
supplement  the  collective  and  individual  risk  criteria  given  in  Section  3.2.  Catastrophic  risk 
assessments  are  especially  useful  for  pre-flight  analyses  intended  to  evaluate  and  mitigate 
potentially  catastrophic  outcomes. 


37  The  term  catastrophic  refers  to  multiple  casualties  with  a  minimum  ranging  from  5  to  10  depending  upon  the 
particular  regulation.  The  criterion  presented  here  is  “risk  averse,”  a  term  that  is  used  in  the  academic  literature  and 
applies  to  all  values  of  N  above  one.  Thus  the  term  catastrophe  averse  is  a  subset  of  the  term  risk  averse.  Another 
expression  that  could  also  be  used  is  aversion  to  increasing  numbers  of  casualties. 
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3.7.1  General 

Missions  must  be  permitted  only  when  the  catastrophic  risks  are  consistent  with  the 
policy  objectives  given  in  Section  2.2, 

3.7.2  Ship  and  Aircraft  Hazard  Areas 

If  ships  and  aircraft  are  excluded  from  the  hazard  areas  designed  to  protect  against 
excessive  probability  of  impact  limits  provided  in  Section  33  and  Section  3  A  in  accordance  with 
the  guidelines  set  in  Chapter  4  of  the  supplement,  then  the  catastrophic  risks  to  ships  and  aircraft 
are  consistent  with  the  policy  objectives  given  in  Section  2.2. 

3.7.3  General  Public  Criteria 

Catastrophic  risks  for  the  GP  should  not  exceed  the  following  provisional  criteria. 

/T>  IV 1  <  (Equation  3-1) 

N 

where 

P[>N]  is  the  cumulative  probability  of  all  events  capable  of  causing  N  or  more 
casualties. 

N  is  number  of  casualties,  based  on  the  occupant  load  as  defined  in  Table  3-3. 
1CT4  is  the  maximum  acceptable  Ec  as  defined  in  b  of  Subsection  3.2.1. 


Table  3-3.  Definitions  Used  to  Define  Tolerable  Catastrophic  Risks 

Population  Type 

Catastrophic  Outcome 

Occupant  Load  ( N) 

Public  Aircraft 

An  occurrence  resulting  in  multiple 
fatalities38,  usually  with  the  loss  of  the 
airplane39 

Maximum  occupancy 

Mission-Essential  or 
Critical  Aircraft 

An  occurrence  resulting  in  multiple  fatalities, 
usually  with  the  loss  of  the  airplane 

Expected  occupancy 

Public  Ship 

An  occurrence  resulting  in  multiple 
casualties,  usually  with  loss  of  the  ship 

Maximum  occupancy 

Mission-Essential  or 
Critical  Ship 

An  occurrence  resulting  in  multiple 
casualties,  usually  with  loss  of  the  ship 

Expected  occupancy 

Public  Land  Vehicle 

An  occurrence  resulting  in  multiple 
casualties,  usually  with  loss  of  the  vehicle 

Maximum  occupancy 

Mission-Essential  or 
Critical  Land  Vehicle 

An  occurrence  resulting  in  multiple 
casualties,  usually  with  loss  of  the  vehicle 

Expected  occupancy 

Public  Train 

An  occurrence  resulting  in  multiple 
casualties,  usually  with  loss  of  the  train 

Maximum  occupancy 

Mission-Essential  or 
Critical  Train 

An  occurrence  resulting  in  multiple 
casualties,  usually  with  loss  of  the  train 

Expected  occupancy 

38  The  FAA  also  has  a  formal  definition  for  “severe  consequence:”  forced  landing  (which  is  also  formally  defined), 
loss  of  aircraft  while  occupants  are  on-board,  serious  injuries  (as  formally  defined),  or  fatalities. 

39  Federal  Aviation  Administration.  “Subject:  Continued  Airworthiness  Assessments  of  Powerplant  and  Auxiliary 
Power  Unit  Installations  of  Transport  Category  Airplanes.”  AC  39-8.  8  September  2003.  Available  at 
http://www.faa.gov/documentLibrarv/media/Advisory  Circular/ AC39-8.pdf. 
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Public  Gatherings40 

An  occurrence  resulting  in  multiple 
casualties 

Maximum  credible 
occupancy 

Mission-Essential  or 
Critical  Personnel 
Gathering 

An  occurrence  resulting  in  multiple 
casualties 

Expected  occupancy 

Figure  3-1  shows  the  relationship  between  P  and  N  for  the  public  that  satisfies  this 
criterion. 


Figure  3- 1 .  Tolerable  Catastrophic  Risks  for  the  Public 


3.7.4  Mission-Essential  and  Critical  Operations  Personnel  Criteria 

Catastrophic  risks  for  MEP  and  COP  should  not  exceed  the  following  provisional  criteria. 

P\>  N]  <  (Equation  3-2) 

N 

where 

P[>NJ  is  the  cumulative  probability  of  all  events  capable  of  causing  N  or  more 
casualties. 

N  is  number  of  casualties,  based  on  the  occupant  load  as  defined  in  Table  3-3. 

3  x  10  4  is  the  maximum  acceptable  Ec  as  defined  in  b  of  Subsection  3.2.2. 


40  Public  gathering  places  subject  to  catastrophic  accidents  include  any  locations  where  population  concentrations 
may  occur,  such  as  schools,  hospitals,  stadiums,  beaches,  etc. 
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3.8  Criteria  Summary 

Table  3-4  summarizes  the  go/no-go  criteria  defined  by  this  document;  Table  3-5  presents 
the  protection  criteria  for  spacecraft.  All  of  the  criteria  are  considered  mandatory  requirements 
except  those  highlighted  by  a  footnote,  which  are  advisory  requirements  that  may  be  considered 
mandatory  under  certain  circumstances  (as  explained  in  Chapter  4  of  the  supplement). 


Table  3-4.  Summary  of  Commonality  Criteria 


General  Public 

Mission-Essential  and  Critical 
Operations  Personnel 

Per 

Mission 

Max. 

Acceptable 

Undesired  Event 

Max. 

Acceptable 

Undesired  Event 

lE-6b 

Individual  Probability 
of  Casualty 

10E-6 

Individual  Probability 
of  Casualty 

100E-6b 

Expected  Casualties 

300E-6 

Expected  Casualties 

0.1E-6a 

Individual  Probability 
of  Fatality 

lE-6a 

Individual  Probability 
of  Fatality 

30E-6 a 

Expected  Fatalities 

300E-6 a 

Expected  Fatalities 

Annual 

3000E-6 

Expected  Casualties 

30000E-6 

Expected  Casualties 

1000E-6 a 

Expected  Fatalities 

10000E-6a 

Expected  Fatalities 

a  Advisory  Requirements. 

b  If  a  flight  operation  creates  a  toxic  risk,  then  the  range  must  separately  ensure  the 
allowable  level  of  risk  enforced  by  them  does  not  exceed  other  standards  for  toxic 
exposure  limits  for  the  GP  when  appropriate  mitigations  are  in  place.  Chapter  8  of  the 
supplement  provides  an  approach  for  implementing  this  requirement. 


Table  3-5.  Summary  of  Commonality  Criteria  For  Spacecraft 


Type  of 
Spacecraft 

Max.  Acceptable 

Undesired  Event 

IE-6 

Individual  Probability  of 
Collision 

Manned 

Ellipsoidal  miss  distance  of  200  km  in 

Collision 

Per 

track  and  50x50  cross-track  and  radial 

Mission 

Spherical  Miss  Distance  200  km 

Collision 

Active 
Satellites  a 

IE-4 

Individual  Probability  of 
Collision 

Ellipsoidal  miss  distance  of  25  km  in 
track  and  7x7  cross  track  and  radial 

Collision 

Spherical  miss  distance  25  km 

Collision 

a  Provisional  requirements 
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Appendix  A 
Glossary 

3-sigma:  Three  times  the  standard  deviation,  typically  referenced  to  the  mean  value. 

Abbreviated  Injury  Scale  (AIS):  An  anatomically  based,  consensus  derived,  global  severity 
scoring  system  that  classifies  each  injury  in  every  body  region  according  to  its  relative 
importance  on  a  6-point  ordinal  scale. 

Acceptable  Risk:  A  predetermined  criterion  or  standard  for  a  maximum  risk  ceiling  that  permits 
the  evaluation  of  cost,  national  priority  interests,  and  number  of  tests  to  be  conducted. 

Accumulated  Risk:  The  combined  collective  risk  to  all  individuals  exposed  to  a  particular 
hazard  through  all  phases  of  an  operation.  Guidance  Information  is  as  follows: 

•  For  the  flight  of  an  expendable  orbital  launch  vehicle,  risk  should  be  accumulated 
from  liftoff  through  orbital  insertion. 

•  For  the  flight  of  a  suborbital  launch  vehicle,  risk  should  be  accumulated  from  liftoff 
through  the  impact  of  all  pieces  of  the  launch  vehicle,  including  the  payload. 

Aggregated  Risk:  The  accumulated  risk  due  to  all  hazards  associated  with  a  flight.  Guidance 
Information  is  that,  for  a  specified  launch,  aggregated  risk  includes,  but  is  not  limited  to,  the  risk 
due  to  debris  impact,  toxic  release,  and  distant  focusing  of  blast  overpressure. 

As  Low  As  Reasonably  Practical:  That  level  of  risk  that  can  be  lowered  further  only  by  an 
increment  in  resource  expenditure  that  cannot  be  justified  by  the  resulting  decrement  in  risk. 
Often  identified  or  verified  by  formal  or  subjective  application  of  cost-benefit  or  multi-attribute 
utility  theory. 

Background  Risk:  risks  voluntarily  accepted  in  the  course  of  normal  activities. 

Best  Practice:  There  are  two  definitions. 

•  A  management  idea  that  asserts  there  is  a  technique,  method,  process,  activity,  or 
incentive  (or  reward)  that  is  more  effective  at  delivering  a  particular  outcome  than 
any  other  technique,  method,  process,  etc.  The  idea  is  that  with  proper  processes, 
checks,  and  testing,  a  project  can  be  rolled  out  and  completed  with  fewer  problems 
and  unforeseen  complications. 

•  An  acceptable  level  of  effort  that  represents  the  best  choice  available  given  the 
circumstances. 

Casualty:  A  serious  injury  or  worse,  including  death,  for  a  human.  For  the  purposes  of  this 
standard,  serious  injury  is  defined  as  AIS  Level  3  or  greater  except  where  prior  general  practice 
at  the  range  has  been  to  protect  to  a  lesser  level  of  injury  than  AIS  level  3,  such  as  eardrum 
protection. 

Casualty  Expectation:  See  Expected  Casualties 

Catastrophe:  Any  event  that  produces  a  large  number  (possibly  five  or  ten  or  more)  casualties 
or  has  a  severe  impact  on  continued  range  operations.  See  also  definition  of  risk  averse 
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Clearance  Zone:  An  area  or  volume  from  which  objects  at  risk  (people,  ships,  aircraft,  etc.)  are 
to  be  restricted  or  eliminated  in  order  to  control  the  risks. 

Collective  Risk:  The  total  risk  to  all  individuals  exposed  to  any  hazard  from  an  operation. 

Unless  otherwise  noted,  collective  risk  is  the  mean  number  of  casualties  (Ec)  predicted  to  result 
from  all  hazards  associated  with  an  operation.  Collective  risk  is  specified  as  either  for  a  mission 
or  per  year.  The  collective  risk  should  include  the  aggregated  and  accumulated  risk. 

Collision  Avoidance  (COLA):  The  process  of  determining  and  implementing  a  course  of  action 
to  avoid  potential  on-orbit  collisions  with  manned  objects  or  with  other  specified  orbiting 
objects.  The  process  includes  the  determination  of  wait  periods  in  either  the  launch  window  or 
spacecraft  thrust  firings  based  on  validated  conjunction  assessments  or  risk  analyses  and 
accounts  for  uncertainties  in  spatial  dispersions  and  arrival  time  of  the  orbiting  objects  and/or 
launch  vehicle. 

Conjunction  Assessment:  The  process  of  determining  the  point  of  closest  approach  of  two 
orbiting  objects,  or  between  a  launch  vehicle  and  an  orbiting  object,  in  association  with  a 
specified  miss-distance  screening  criteria  or  the  corresponding  probability  of  collision. 
Associated  with  the  closest  approach  assessment  is  the  closest  approach  distance,  the  times  of 
launch  or  orbital  firing  that  would  result  in  the  closest  approach,  and  meeting  the  miss-distance 
or  collision  probability  criteria. 

Conservatism:  As  used  in  risk  analysis  conservative  modeling,  conservatism  is  a  set  of 
modeling  assumptions  that  overstates  the  risk  by  overstating  event  probabilities,  hazard 
probabilities,  or  consequences.  Conservatism  refers  to  the  degree  of  overstating  risk. 

Containment:  The  launch  safety  strategy/process  of  minimizing  risk  to  the  maximum  extent 
practical  by  keeping  hazardous  operations  within  defined  hazard  areas  that  are  unpopulated  or 
where  the  population  is  controlled  and  adequate  protection  can  be  provided  to  highly  valued 
resources;  to  stop,  hold,  or  surround  a  hazard. 

Critical  Asset:  A  resource  requiring  protection.  It  normally  includes  property/  infrastructure  that 
is  essential  to  protect  the  public  health  and  safety,  maintain  the  minimum  operations  of  the  range, 
or  protect  the  national  security  or  foreign  policy  interests  of  the  United  States. 

Critical  Operations  Personnel:  Persons  not  essential  to  the  specific  operation  or  launch 
currently  being  conducted,  but  who  are  required  to  perform  safety,  security,  or  other  critical 
tasks  at  the  range.  To  be  treated  as  COP  they  must  be  notified  of  a  neighboring  hazardous 
operation  and  either  trained  in  mitigation  techniques  or  accompanied  by  a  properly  trained 
escort.  The  COP  does  not  include  individuals  in  training  for  any  job  or  individuals  performing 
routine  activities  such  as  administrative,  maintenance,  or  janitorial.  The  COP  may  occupy  safety 
clearance  zones  and  hazardous  launch  areas  and  may  not  need  to  be  evacuated  with  the  GP.  The 
COP  should  be  included  in  the  same  risk  category  as  MEP. 

Damage  Severity:  This  term  refers  primarily  to  the  extent  of  the  adverse  consequences  of 
hazards  to  infrastructure.  In  contrast  to  injury  to  people,  injury  to  infrastructure  must  be 
evaluated  at  both  the  unit  component  level  and,  following  that,  at  the  system-level.  The 
recommended  infrastructure  protection  process  accommodates  this  process  using  a  two-tiered 
approach. 

Decision  Authority:  The  range  commander  or  senior  official  designated  by  the  range 
commander  to  make  risk  decisions  on  his  or  her  behalf. 
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Distant  Focusing:  An  atmospheric  phenomenon  that  can  produce  greatly  enhanced 
overpressures  at  a  distance  from  the  acoustic  (or  explosive)  source  due  to  sonic  velocity 
gradients  with  respect  to  altitude 

Endoatmospheric:  Within  the  Earth’s  atmosphere;  generally  considered  to  be  those  altitudes 
below  100  km. 

Exoatmospheric:  Outside  the  Earth’s  atmosphere;  generally  considered  to  be  those  altitudes 
above  100  km. 

Expected  Casualties:  The  mean  number  of  casualties  predicted  to  occur  as  a  result  of  an 
operation  if  the  operation  were  to  be  repeated  many  times.  This  risk  is  expressed  with  the 
following  notation:  IE-7  =  lO-7  =  1  in  ten  million. 

Expected  Fatalities:  The  mean  number  of  fatalities  predicted  to  occur  as  a  result  of  an  operation 
if  the  operation  were  to  be  repeated  many  times.  This  risk  is  expressed  with  the  following 
notation:  IE-7  =  1 0  7  =  1  in  ten  million. 

Fatal  Injury:  any  injury  that  results  in  death  within  30  days  of  the  accident. 

Fragmentation:  The  breakup  of  an  in-flight  vehicle  into  fragments  (components  of  the  vehicle, 
pieces  of  the  structure,  chunks  of  solid  propellant,  miscellaneous  hardware,  etc.)  due  to  explosive 
loads,  aerodynamic  and  inertial  loads,  activation  of  an  FTS,  intercept  with  another  vehicle,  or 
impact  on  a  surface. 

Federal  Tort  Claims  Act  (FTCA).41  A  statute  that  limits  federal  sovereign  immunity  and 
allows  recovery  in  federal  court  for  tort  damages  caused  by  federal  employees,  but  only  if  the 
law  of  the  state  where  the  injury  occurred  would  hold  a  private  person  liable  for  the  injury. 

Fidelity:  The  accuracy  of  the  representation  when  compared  to  the  real  world. 

Flight  Termination  System  (FTS):  The  airborne  portion  of  the  flight  safety  system.  An  FTS 
ends  the  flight  of  a  vehicle  and  consists  of  the  entire  system  on  an  airborne  vehicle  used  to 
receive,  decode,  and  execute  the  ground  signals.  It  includes  all  wiring,  power  systems,  and 
methods  or  devices  (including  inadvertent  separation  destruct  systems)  used  to  terminate  flight. 

General  Public:  People  who  are  not  declared/identified  as  MEP  or  COP.  This  includes  the 
public  plus  range  personnel  not  essential  to  a  mission,  visitors,  press,  and  personnel/dependents 
living  on  the  base/  facility. 

Hazard:  Any  real  or  potential  condition  that  can  cause  injury,  illness,  or  death  of  personnel,  or 
damage  to  or  loss  of  equipment  or  property. 

Hazard  Threshold:  The  lowest  level  at  which  adverse  outcomes  are  expected  to  appear. 

Hazard  Area:  A  geographical  or  geometrical  surface  area  that  is  susceptible  to  a  hazard  from  a 
planned  event  or  unplanned  malfunction. 

Hazard  Volume:  A  geographical  or  geometrical  volume  of  airspace  that  is  susceptible  to  a 
hazard  from  a  planned  event  or  unplanned  malfunction. 

Hazardous  Operation:  Those  activities  that,  by  their  nature,  expose  personnel  or  property  to 
dangers  not  normally  experienced  in  day-to-day  actions. 


41  Tort  Claims  Procedure.  28  U.S.C.  §  2671-2680. 
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Impact:  The  impingement  of  a  fragment  on  a  surface,  a  structure,  a  person,  or  a  vehicle. 

Inadvertent  Separation  Destruct  System:  a  specialized  form  of  ADS  located  on  vehicle 
components  that  automatically  activates  when  inadvertent  separation  of  the  component  from  the 
main  vehicle  is  sensed.  There  is  often  a  built-in  delay  included,  in  hope  that  the  separated 
component  will  be  sufficiently  displaced  at  charge  activation  to  preclude  damage  to  the  main 
vehicle. 

Individual  Risk:  The  risk  that  a  person  will  suffer  a  consequence.  Unless  otherwise  noted, 
individual  risk  is  expressed  as  the  probability  that  an  individual  will  become  a  casualty  due  to  all 
hazards  from  an  operation  at  a  specific  location.  Guidance  information  is  that  as  follows. 

•  If  each  person  in  a  group  is  subject  to  the  same  individual  risk,  then  the  collective  risk 
may  be  computed  as  the  individual  risk  multiplied  by  the  number  of  people  in  the 
group. 

•  In  the  context  of  this  document,  individual  risk  refers  to  the  probability  that  the 
exposed  individual  will  become  a  casualty  as  a  result  of  all  hazards  from  a  mission. 

Informed  Decision:  Principle  that  is  used  in  tort  claims  against  the  US  Government.  The  FTCA 
enjoins  the  U.S.  court  system  from  second-guessing  decisions  made  by  properly  authorized 
government  officials  in  determining  the  acceptability  of  operational  risks.  A  key  test  under  the 
FTCA  requires  that  the  decision-making  official  be  fully  advised  and  informed  of  the  known 
risks.  Failure  to  fully  advise  the  decision-making  authority  of  known  risks  can  result  in  liability 
of  the  US  Government  or  its  officials. 

Involuntary  Activity:  No  choice  was  made  by  the  person  affected  that  placed  them  in  a  position 
of  increased  risk;  or  the  activity  participated  in  or  the  item  used  was  one  that  is  generally  done  or 
used  by  more  than  99%  of  the  population.  Examples:  bathing,  using  coins,  or  drinking  from 
glasses. 

Launch  Mission:  For  the  purposes  of  flight  safety  analyses,  a  launch  mission  begins  with  lift¬ 
off,  ends  at  orbital  insertion,  and  includes  impacts  from  all  planned  debris  released  prior  to 
orbital  insertion  (or  final  impact  for  a  suborbital  mission).  A  launch  mission  includes  any  flight 
of  a  suborbital  or  orbital  rocket,  guided  or  unguided  missile,  and  missile  intercepts.  See  the 
supplement  Subsection  4.2.5  for  details  on  defining  a  launch  mission  for  risk  assessment. 

Lift-off:  For  the  purposes  of  flight  safety  analyses,  lift-off  occurs  during  a  launch  countdown 
with  any  motion  of  the  launch  vehicle  with  respect  to  the  launch  platform  (that  includes  a  carrier 
aircraft),  including  any  intentional  or  unintentional  separation  from  the  launch  platform. 

Manned  Spacecraft:  a  spacecraft  that  is  either  currently  occupied  or  intended  to  be  occupied. 
Includes  spacecraft  en  route  to,  and  in  support  of,  manned  missions. 

Mishap:  An  unplanned  event  or  series  of  events  resulting  in  death,  injury,  occupational  illness, 
or  damage  to  or  loss  of  equipment  or  property  or  damage  to  the  environment. 

Mission-Essential:  Those  persons  and  assets  necessary  to  safely  and  successfully  complete  a 
specific  hazardous  operation  or  launch.  The  mission-essential  individuals  may  include  persons 
in  training  to  perform  the  specific  mission  currently  being  conducted,  but  excludes  those  in 
training  for  other  critical  tasks.  The  MEP  are  informed  of  the  hazards  associated  with  the 
operation  and  trained  in  mitigation  techniques  appropriate  to  the  hazard  level.  The  range 
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commander  or  mission  director  (or  their  designees)  should  identify  the  MEP  in  training  and 
justify  their  designation  as  mission-essential. 

Mission  Rules:  Rules  that  define  safety  constraints  and  conditions  and  establish  the  boundaries 
within  which  the  safety  team  operates.  The  lead  safety  organization  develops  the  mission  rules 
and  briefs  the  range  user  to  ensure  a  complete  understanding  of  the  intent  and  application  of 
them.  Mission  rules  are  documented  and  become  part  of  the  range  safety  plan. 

Orbital  Insertion:  Orbital  insertion  occurs  when  the  vehicle  achieves  a  minimum  70-nautical 
mile  (nm)  perigee  based  on  a  computation  that  accounts  for  drag. 

Overpressure:  The  pressure  caused  by  an  explosion  over  and  above  normal  atmospheric 
pressure.  It  can  be  significantly  affected  by  the  atmospheric  conditions,  particularly  the 
temperature  and  wind  profiles. 

Probability  of  Casualty:  The  likelihood  that  a  person  will  suffer  a  serious  injury  or  worse, 
including  a  fatal  injury,  from  a  hazardous  event.  This  risk  is  expressed  with  the  following 
notation:  IE-7  =  10  7  =  1  in  ten  million. 

Probability  of  Fatality:  The  likelihood  that  a  person  will  die  from  a  hazardous  event.  This  risk 
is  expressed  with  the  following  notation:  IE-7  =  10  7  =  1  in  ten  million. 

Prudent  Person:  See  Reasonable  Person 

Public  Infrastructure:  Infrastructure  that  is  owned  by  the  public  or  is  for  public  use.  It  is 
generally  distinguishable  from  private  or  generic  infrastructure  in  terms  of  policy,  financing,  or 
purpose. 

Range  Safety  System:  The  ground-based  portion  of  the  flight  safety  system.  See  also  Flight 
Safety  System  and  Flight  Termination  System 

Reasonable  Care:  As  a  test  of  liability  for  negligence,  the  degree  of  care  that  a  prudent  and 
competent  person  engaged  in  the  same  line  of  business  or  endeavor  would  exercise  under  similar 
circumstances  -  also  termed  due  care;  ordinary  care;  adequate  care;  proper  care. 

Reasonable  Person:  A  hypothetical  person  used  as  a  legal  standard,  especially  to  determine  if 
someone  acted  with  negligence.  The  reasonable  person  acts  sensibly,  does  things  without  serious 
delay,  and  takes  proper  but  not  excessive  precautions.  Also  termed  Reasonable  Man  or  Prudent 
Person. 

Reentry  Mission:  Reentry  missions  include  both  controlled  and  uncontrolled  reentries.  In  this 
context,  a  controlled  reentry  mission  begins  with  the  final  commitment  to  enter  the  atmosphere 
from  orbit  (or  otherwise  from  outer  space)  and  ends  when  all  vehicle  components  associated  with 
the  reentry  come  to  rest  on  the  Earth  (or  are  otherwise  secured).  For  example,  a  controlled 
reentry  mission  could  begin  with  the  final  command  to  commit  the  vehicle  (or  object)  to  a 
perigee  below  70  nm  and  end  when  all  vehicle  components  come  to  rest  on  the  Earth.  An 
uncontrolled  reentry  mission  begins  when  the  object  naturally  decays  to  a  perigee  below  70  nm 
and  ends  when  all  vehicle  components  associated  with  the  reentry  come  to  rest  on  the  Earth.  The 
reentry  of  upper  stages  and  payloads  are  separate  reentry  missions  per  the  US  Government 
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Orbital  Debris  Mitigation  Standard  Practices42  and  DoDI  3 100. 12. 43  In  this  context,  reentry 
missions  do  not  occur  during  suborbital  flights  because  a  reentry  mission  separate  from  the 
launch  mission  can  occur  subsequent  to  orbital  insertion  only.  See  the  supplement  Chapter  4  for 
details  on  defining  a  reentry  mission  for  risk  assessment. 

Risk:  A  measure  that  accounts  for  both  the  probability  of  occurrence  and  the  consequence  of  a 
hazard  to  a  population  or  installation.  Unless  otherwise  noted,  risk  to  people  is  measured  in 
casualties  and  expressed  as  individual  risk  or  collective  risk. 

Risk  Analysis:  A  study  of  potential  risk  under  a  given  set  of  conditions.  Risk  analysis  is  an 
activity  that  includes  the  complete  array  of  tasks  from  data  gathering,  identification  of  hazards, 
estimation  of  associated  risks,  and  verification  of  results. 

Risk  Averse:  An  aversion  to  increasing  numbers  of  casualties  that  makes  a  single  event  having, 
for  example,  two  casualties  more  than  twice  as  undesirable  as  a  single  event  having  one  casualty. 
This  is  exactly  equivalent  to  the  term  catastrophe  averse  when  the  number  of  casualties  is  large. 
The  term  “large”  could  be  10  in  some  definitions. 

Risk  Management:  A  systematic  and  logical  process  to  identify  hazards  and  control  the  risk 
they  pose. 

Risk  Profile:  A  plot  that  shows  the  probability  of  N  or  more  casualties  (vertical  axis)  as  a 
function  of  the  number  of  casualties,  N  (horizontal  axis).  It  is  discrete  (not  fractional)  and  is  the 
complementary  cumulative  distribution  of  the  histogram  representing  the  aleatory  uncertainty  of 
number  of  casualties.  The  mean  of  the  histogram  is  the  Ec.  In  addition,  the  sum  of  the  values  of 
the  P[>N]  over  all  N  is  equal  to  the  Ec. 

Safety:  Relative  protection  from  adverse  consequences. 

Serious  Injury:  Any  injury  that  meets  one  or  more  of  the  following: 

•  requires  hospitalization  for  more  than  48  hours,  commencing  within  7  days  from  the 
date  the  injury  was  received; 

•  results  in  a  fracture  of  any  bone  (except  simple  fractures  of  fingers,  toes,  or  nose); 

•  causes  severe  hemorrhages,  nerve,  muscle,  or  tendon  damage; 

•  involves  any  internal  organ; 

•  involves  second  degree  or  third  degree  burns,  or  any  bums  affecting  more  than  5 
percent  of  the  body  surface. 

Ship  Accident:  A  “ship  accident”  occurs  if  the  vessel  is  involved  in  an  accident  that  results  in 
loss  of  life,  personal  injury  that  requires  medical  treatment  beyond  first  aid,  or  complete  loss  of 
the  vessel.  This  definition  is  consistent  with  the  level  of  protection  afforded  people  involved  in  a 
“boat  accident”  as  defined  in  current  regulations. 

Sigma:  Standard  deviation. 


42  United  States  Federal  Government.  US  Government  Orbital  Debris  Mitigation  Standard  Practices.  Retrieved  28 
July  2016.  Available  at  http://orbitaldebris.isc.nasa.gov/librarv/usg  od  standard  practices.pdf. 

43  Department  of  Defense.  “Subject:  Space  Support.”  DoDI  3100.12.  14  September  2000.  May  be  superseded  by 
update.  Retrieved  6  April  2016.  Available  at  http://www.dtic.mil/whs/directives/con~es/pdf/310012p.pdf. 
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Suborbital  Mission:  Any  flight  of  a  launch  vehicle,  rocket,  or  missile  that  does  not  achieve 
orbital  insertion.  The  per-mission  requirements  for  launch  are  intended  to  apply  from  lift-off 
until  landing  or  final  impact  for  a  suborbital  mission,  including  all  planned  debris  impacts. 

Suborbital  Rocket:  A  rocket-propelled  vehicle  intended  to  perform  a  suborbital  mission  whose 
thrust  is  greater  than  its  lift  for  the  majority  of  the  rocket-powered  portion  of  its  flight. 

Substantial  Damage:  Relating  to  aircraft  vulnerability  means  damage  or  failure  that  adversely 
affects  the  structural  strength,  performance,  or  flight  characteristics  of  the  aircraft  and  that  would 
normally  require  major  repair  or  replacement  of  the  affected  component. 

Toxic  Substance:  A  chemical  or  mixture  that  may  present  an  unreasonable  risk  of  injury  to 
health  or  the  environment. 

Toxics:  A  generic  term  for  the  toxic  propellants  and  combustion  by-products  resulting  from  a 
nominal  launch  vehicle  flight  or  catastrophic  launch  abort. 

Uncertainty:  The  absence  of  perfectly  detailed  knowledge.  Uncertainty  includes  incertitude  (the 
exact  value  is  unknown)  and  variability  (the  value  is  changing).  Uncertainty  may  also  include 
other  forms  such  as  vagueness,  ambiguity,  and  fuzziness  (in  the  sense  of  borderline  cases). 

Unit  Component:  The  minimal  set  or  collection  of  equipment  that  is  necessary  to  fulfill  a  basic 
function  required  of  public  infrastructure.  Basic  functions  generally  include  generation,  storage, 
and  routing  of  energy  in  some  form.  Damage  to  a  unit  component  will  have  a  measurable 
adverse  impact  upon  the  functionality  of  the  larger  system  to  which  the  unit  component  belongs. 
For  example,  a  single  wind  turbine  is  a  unit  component  of  a  wind  turbine  farm.  A  photovoltaic 
power  module  is  a  unit  component  of  a  photovoltaic  installation.  Conceptually,  unit  components 
can  frequently  be  sub-divided  further;  however,  from  the  standpoint  of  infrastructure  protection, 
the  critical  demarcation  is  with  respect  to  the  system-level  functionality  that  is  of  concern  to 
stakeholders.  As  an  example,  a  photovoltaic  module  in  a  modern  solar  facility  is  itself  composed 
of  several  hundred  or  more  individual  solar  panels.  The  individual  panels  are  not  considered  unit 
components  since  the  impairment  to  the  functionality  of  the  photovoltaic  module  due  to  damage 
of  a  single  panel  is  negligible.  On  the  other  hand,  hazards  sufficient  to  cause  damage  to  the 
functionality  at  the  module  level  represent  a  non-negligible  impairment  in  the  absence  of 
mitigation  to  the  functionality  (i.e.,  normal  and  expected  operation)  and  output  of  a  solar  farm. 

Variability:  Observed  differences  attributable  to  true  heterogeneity  or  diversity.  Variability  is 
the  result  of  natural  random  processes  and  is  usually  not  reducible  by  further  measurement  or 
study  (although  it  can  be  better  characterized). 

Verification:  refers  to  the  set  of  activities  that  ensure  that  software  correctly  implements  a 
specific  function.  The  verification  process  determines  whether  a  computer  simulation  code  for  a 
particular  problem  accurately  represents  the  solutions  of  the  mathematical  model.  Evidence  is 
collected  to  ascertain  whether  the  numerical  model  is  being  solved  correctly.  This  process 
ensures  that  sound  software-quality  practices  are  used  and  the  software  codes  themselves  are  free 
of  defects  and  errors.  It  also  checks  that  the  code  is  correctly  solving  the  mathematical  equations 
in  the  algorithms  and  verifies  that  the  time  and  space  steps  or  zones  chosen  for  the  mathematical 
model  are  sufficiently  resolved. 

Voluntary  Activity:  The  person  affected  made  a  choice  that  placed  him  or  her  in  an  increased 
position  of  risk  compared  to  the  rest  of  the  population.  This  includes  career  and  job  choices. 
Examples  include  repetitive  motion  injuries,  recreational  boating,  etc. 
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